Filter Chain-Based Authentication vs AuthenticationFilte

The old Spring Security approach is generally referred to as:

🛑 "Filter Chain-Based Authentication" (Old Logic)

How it worked?
- Used a chain of filters (e.g., UsernamePasswordAuthenticationFilter, BearerTokenAuthenticationFilter).
- Authentication was handled inside filters, directly coupled to HTTP request processing.
- Session-based or stateless (JWT) depending on how you configured Spring Security.

Example Old Approach for JWT (Bearer Token Authentication)


http
    .csrf(csrf -> csrf.disable())
    .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
    .addFilterBefore(new JwtFilter(), UsernamePasswordAuthenticationFilter.class) // Old way
    .authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

🔻 Problems with this approach:

Authentication was tightly coupled to filters.
Harder to customize authentication mechanisms (e.g., token from cookies instead of header).
AuthenticationManager was less flexible.

🚀 New Logic: AuthenticationFilter (Decoupled & Modular)

Spring Security modernized authentication with AuthenticationFilter, which is more modular and supports multiple authentication types without relying on old filter chains.

Key Differences Between Old vs. New:

Feature	Old (Filter-Based Authentication)	New (AuthenticationFilter-Based)
Bearer Token Handling	`BearerTokenAuthenticationFilter` (Part of filter chain)	`AuthenticationFilter` (More flexible)
Customization	Harder (Tightly coupled to filters)	Easier (Uses `AuthenticationConverter`)
Session Usage	Often session-based (unless configured stateless)	Fully stateless by design
Code Complexity	More boilerplate to customize	Cleaner, decoupled approach

🏆 Is Bearer Token Old?

✅ Yes, but only in the way it was implemented before.

Bearer token authentication (JWT) is still widely used.
The old way used BearerTokenAuthenticationFilter inside the filter chain.
The new way (AuthenticationFilter) allows more flexibility and customization.

🚀 So, JWT/Bearer tokens are NOT outdated, but the way they are handled in Spring Security has improved!