web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {

		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);

			return;
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Request is to process authentication");
		}

		Authentication authResult;

		try {
			authResult = attemptAuthentication(request, response);
			if (authResult == null) {
				// return immediately as subclass has indicated that it hasn't completed
				// authentication
				return;
			}
			sessionStrategy.onAuthentication(authResult, request, response);
		}
		catch (InternalAuthenticationServiceException failed) {
			logger.error(
					"An internal error occurred while trying to authenticate the user.",
					failed);
			unsuccessfulAuthentication(request, response, failed);

			return;
		}
		catch (AuthenticationException failed) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, failed);

			return;
		}

		// Authentication success
		if (continueChainBeforeSuccessfulAuthentication) {
			chain.doFilter(request, response);
		}

		successfulAuthentication(request, response, chain, authResult);
	}
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {

		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);

			return;
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Request is to process authentication");
		}

		Authentication authResult;

		try {
			authResult = attemptAuthentication(request, response);
			if (authResult == null) {
				// return immediately as subclass has indicated that it hasn't completed
				// authentication
				return;
			}
			sessionStrategy.onAuthentication(authResult, request, response);
		}
		catch (InternalAuthenticationServiceException failed) {
			logger.error(
					"An internal error occurred while trying to authenticate the user.",
					failed);
			unsuccessfulAuthentication(request, response, failed);

			return;
		}
		catch (AuthenticationException failed) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, failed);

			return;
		}

		// Authentication success
		if (continueChainBeforeSuccessfulAuthentication) {
			chain.doFilter(request, response);
		}

		successfulAuthentication(request, response, chain, authResult);
	}
Invokes the
{@link #requiresAuthentication(HttpServletRequest, HttpServletResponse)
requiresAuthentication} method to determine whether the request is for
authentication and should be handled by this filter. If it is an authentication
request, the
{@link #attemptAuthentication(HttpServletRequest, HttpServletResponse)
attemptAuthentication} will be invoked to perform the authentication. There are
then three possible outcomes:
<ol>
<li>An <tt>Authentication</tt> object is returned. The configured
{@link SessionAuthenticationStrategy} will be invoked (to handle any
session-related behaviour such as creating a new session to protect against
session-fixation attacks) followed by the invocation of
{@link #successfulAuthentication(HttpServletRequest, HttpServletResponse, FilterChain, Authentication)}
method</li>
<li>An <tt>AuthenticationException</tt> occurs during authentication. The
{@link #unsuccessfulAuthentication(HttpServletRequest, HttpServletResponse, AuthenticationException)
unsuccessfulAuthentication} method will be invoked</li>
<li>Null is returned, indicating that the authentication process is incomplete. The
method will then return immediately, assuming that the subclass has done any
necessary work (such as redirects) to continue the authentication process. The
assumption is that a later request will be received by this method where the
returned <tt>Authentication</tt> object is not null.
</ol>