Explain the execution flow of a request through the Spring Security filter chain?

Every request to a secured application first passes through a single servlet Filter, FilterChainProxy, which delegates to an ordered list of security filters matched to that request's SecurityFilterChain.

flowchart LR
    A[Request] --> B[FilterChainProxy]
    B --> C[SecurityContextHolderFilter]
    C --> D[CsrfFilter]
    D --> E[Authentication Filter]
    E --> F[ExceptionTranslationFilter]
    F --> G[AuthorizationFilter]
    G --> H[DispatcherServlet / Controller]

Early filters establish context: SecurityContextHolderFilter loads any existing authentication from the session (or leaves it empty for a stateless JWT setup), and CsrfFilter validates state-changing requests against a CSRF token. An authentication filter appropriate to the configured mechanism - form login, HTTP Basic, a bearer-token resolver, or an OAuth2 login filter - attempts to authenticate the request if it isn't already. ExceptionTranslationFilter wraps everything downstream of it, catching AuthenticationException and AccessDeniedException to redirect to a login page or return a 401/403 as appropriate rather than letting them propagate as generic 500 errors. Finally, AuthorizationFilter makes the actual access decision by consulting the configured AuthorizationManager rules (like the requestMatchers(...).hasAuthority(...) chain) before allowing the request through to DispatcherServlet and the controller.