Spring Security - Custom Pre Auth filter using java config -

i trying configure simple custom authentication filter checks token on every page of web app except '/login' page. right now, filter , running, no matter settings change, filter being called on every page, including '/login' have set permitall().

when access localhost:8080/login, expect not call filter based on configuration below, instead throws exception in filter because no session found.

my question how limit filter pages except '/login' page?

here config:

@configuration @enablewebmvcsecurity public class securityconfig extends websecurityconfigureradapter{  private userdetailsservice userdetailsservice; private preauthenticatedauthenticationprovider preauthenticatedprovider;  public securityconfig() {     super();      userdetailsservice = new userdetailsserviceimpl();     userdetailsbynameservicewrapper<preauthenticatedauthenticationtoken> wrapper =              new userdetailsbynameservicewrapper<preauthenticatedauthenticationtoken>(userdetailsservice);      preauthenticatedprovider = new preauthenticatedauthenticationprovider();     preauthenticatedprovider.setpreauthenticateduserdetailsservice(wrapper); }  @autowired public void configureglobal(authenticationmanagerbuilder auth) throws exception {     auth.authenticationprovider(preauthenticatedprovider); }  @override protected void configure(httpsecurity http) throws exception {     opentokenrequestauthenticationfilter filter = new opentokenrequestauthenticationfilter();     filter.setauthenticationmanager(authenticationmanager());       http         .addfilter(filter)         .authorizerequests()             .antmatchers("/login").permitall(); }  } 

and here filter:

    public class opentokenrequestauthenticationfilter extends         abstractpreauthenticatedprocessingfilter {      /**      * logger class      */     private static final logger logger = loggerfactory.getlogger(opentokenrequestauthenticationfilter.class);      @autowired     private exceptionmappingauthenticationfailurehandler authenticationfailurehandler;      @autowired     private iopentokenreader opentokenreader;      private string logouturl;      @override     public void dofilter(servletrequest request, servletresponse response,             filterchain chain) throws ioexception, servletexception {         httpservletrequest httpservletrequest = (httpservletrequest)request;         httpservletresponse httpservletresponse = (httpservletresponse)response;         super.dofilter(httpservletrequest, httpservletresponse, chain);         httpsession session = httpservletrequest.getsession(false);         if(session != null && session.getattribute("ssotoken") != null)         {             ssotoken ssotoken = (ssotoken)session.getattribute("ssotoken");             httpservletresponse.addheader("agentname", ssotoken.getname());             httpservletresponse.addheader("agentid", ""+ssotoken.getloginid());         }     }      /**      *       */     protected object getpreauthenticatedprincipal(httpservletrequest request) {         string principal = null;         httpsession session = null;          try {             session = request.getsession(false);             string tokenname = opentokenreader.gettokenname();              if (tokenname != null && request.getparameter(tokenname.trim()) != null && !request.getparameter(tokenname.trim()).isempty()) {                 logger.info("token found in request. token name:  "+ tokenname);                 ssotoken ssotoken = null;                 if (session != null) {                     session.invalidate();                     logger.info("invalidated old session , creating new session since request found new token.");                 }                 session = request.getsession(true);//create new session                 logger.info("new session created: "+session.getid());                  agent agent = opentokenreader.getagent();                 map result = agent.readtoken(request);                 if (result != null) {                     principal = (string) result.get("subject");                     ssotoken = new ssotoken();                     ssotoken.setlogouturl(getlogouturl()); //                  ssotoken.setname((string) result.get("lastname") +", "+(string) result.get("firstname"));                     ssotoken.setname((string) result.get("firstname"));                     ssotoken.setaffiliate((result.get("isaffiliate") != null && !((string)result.get("isaffiliate")).trim().equals("false")) ? true : false);                     if(ssotoken.isaffiliate())                         ssotoken.setloginid((string) result.get("affiliateid"));                     else                         ssotoken.setloginid((string) result.get("subject"));                 }                 session.setattribute("ssotoken", ssotoken);                 boolean isinvalidtoken = hasinvalidtokendata(ssotoken);                 if (isinvalidtoken) {                     throw new preauthenticatedcredentialsnotfoundexception("invalid token found in request.");                 } else {                     session.setattribute("hasvalidtoken", true);                 }             }          } catch (exception e) {             logger.error("exception while reading token " + e);         }         if(session == null )             throw new preauthenticatedcredentialsnotfoundexception("no session found.");         if(session != null && session.getattribute("hasvalidtoken") == null)             throw new preauthenticatedcredentialsnotfoundexception("no attribute 'hasvalidtoken' found in session.");         if(session != null && session.getattribute("hasvalidtoken") != null && !(boolean) session.getattribute("hasvalidtoken"))             throw new preauthenticatedcredentialsnotfoundexception("value of  attribute 'hasvalidtoken' false in session.");          /*if (session == null || session.getattribute("hasvalidtoken") == null || !((boolean) session.getattribute("hasvalidtoken"))){             throw new preauthenticatedcredentialsnotfoundexception("token not found in request.");         }*/         if(session != null && session.getattribute("ssotoken") != null)         {             ssotoken ssotoken = (ssotoken)session.getattribute("ssotoken");             principal = ssotoken.getloginid();         }          return principal;     }     public boolean hasinvalidtokendata(ssotoken token) {         boolean hasinvalidtokendata = false;         if (token == null) {             hasinvalidtokendata = true;         } else {             if (stringutils.isblank(token.getloginid())) {                 logger.debug("login id blank.");                 hasinvalidtokendata = true;             }         }         if (logger.isdebugenabled()) {             logger.debug("exiting: hasinvalidtokendata(ssotoken)");             logger.debug("hasinvalidtokendata=|" + hasinvalidtokendata + "|");         }         return hasinvalidtokendata;     }     @override     protected object getpreauthenticatedcredentials(httpservletrequest request) {         return "";     }      /**      * @return logouturl      */     public string getlogouturl() {         return logouturl;     }      /**      * @param logouturl logouturl set      */     public void setlogouturl(string logouturl) {         this.logouturl = logouturl;     }      public void setauthenticationfailurehandler(exceptionmappingauthenticationfailurehandler authenticationfailurehandler){         this.authenticationfailurehandler = authenticationfailurehandler;     }      public exceptionmappingauthenticationfailurehandler getauthenticationfailurehandler(){         return authenticationfailurehandler;     }