HTTP Request
  ↓
Filter Chain（doFilter）
  ↓
DispatcherServlet
  ↓
Interceptor.preHandle
  ↓
Controller Method
  ↓
Interceptor.postHandle
  ↓
View Rendering（如有）
  ↓
Interceptor.afterCompletion
  ↓
Filter Chain（返回響應(yīng)）

@Component
public class LogFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        long startTime = System.currentTimeMillis();
        HttpServletRequest req = (HttpServletRequest) request;
        // 前置處理
        System.out.println("Request URI: " + req.getRequestURI());
        chain.doFilter(request, response); // 放行請求
        // 后置處理
        long duration = System.currentTimeMillis() - startTime;
        System.out.println("Request completed in " + duration + "ms");
    }
}

@Configuration
public class FilterConfig {
    @Bean
    public FilterRegistrationBean<LogFilter> loggingFilter() {
        FilterRegistrationBean<LogFilter> registration = new FilterRegistrationBean<>();
        registration.setFilter(new LogFilter());
        registration.addUrlPatterns("/api/*");
        registration.setOrder(Ordered.HIGHEST_PRECEDENCE); // 設(shè)置優(yōu)先級
        return registration;
    }
}

@Component
public class AuthInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, 
                           HttpServletResponse response, 
                           Object handler) throws Exception {
        String token = request.getHeader("Authorization");
        if (!validateToken(token)) {
            response.sendError(401, "Invalid token");
            return false; // 中斷請求
        }
        return true;
    }
    @Override
    public void postHandle(HttpServletRequest request, 
                          HttpServletResponse response, 
                          Object handler,
                          ModelAndView modelAndView) throws Exception {
        // Controller方法執(zhí)行后，視圖渲染前
    }
    @Override
    public void afterCompletion(HttpServletRequest request, 
                               HttpServletResponse response, 
                               Object handler, 
                               Exception ex) throws Exception {
        // 請求完全結(jié)束后（包括視圖渲染）
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Autowired
    private AuthInterceptor authInterceptor;
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authInterceptor)
                .addPathPatterns("/**")
                .excludePathPatterns("/login", "/public/**");
    }
}

Filter1 → Filter2 → Interceptor.preHandle 
→ Controller 
→ Interceptor.postHandle 
→ Interceptor.afterCompletion 
→ Filter2 → Filter1

// 在過濾器中處理異常
public void doFilter(...) {
    try {
        chain.doFilter(request, response);
    } catch (Exception e) {
        response.sendError(500, "Server Error");
    }
}
// 在攔截器中處理異常
@ControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(Exception.class)
    public ResponseEntity<?> handleException(Exception e) {
        return ResponseEntity.internalServerError().body("Error occurred");
    }
}

// 攔截器需實(shí)現(xiàn)AsyncHandlerInterceptor
@Override
public void afterConcurrentHandlingStarted(HttpServletRequest request, 
                                          HttpServletResponse response, 
                                          Object handler) {
    // 異步請求的特殊處理
}

是否需要處理靜態(tài)資源？
├─ 是 → 必須使用Filter
└─ 否 → 
   是否需要訪問Spring Bean？
   ├─ 是 → 選擇Interceptor
   └─ 否 → 
      是否需要最早處理請求？
      ├─ 是 → 選擇Filter
      └─ 否 → 根據(jù)業(yè)務(wù)復(fù)雜度選擇

// 攔截器實(shí)現(xiàn)
public class MetricsInterceptor implements HandlerInterceptor {
    private static final ThreadLocal<Long> startTime = new ThreadLocal<>();
    @Override
    public boolean preHandle(...) {
        startTime.set(System.currentTimeMillis());
        return true;
    }
    @Override
    public void afterCompletion(...) {
        long duration = System.currentTimeMillis() - startTime.get();
        metricsService.recordRequestTime(request.getRequestURI(), duration);
        startTime.remove();
    }
}

public class ReplayAttackFilter implements Filter {
    private Cache<String, Boolean> requestCache = 
        Caffeine.newBuilder().expireAfterWrite(5, TimeUnit.MINUTES).build();
    @Override
    public void doFilter(...) {
        String nonce = request.getHeader("X-Nonce");
        if (requestCache.getIfPresent(nonce) != null) {
            response.sendError(400, "Duplicate request");
            return;
        }
        requestCache.put(nonce, true);
        chain.doFilter(request, response);
    }
}