Also see:

getAlreadyFilteredAttributeName

 public final  void doFilter(ServletRequest request,
    ServletResponse response,
    FilterChain filterChain) throws IOException, ServletException 
{
	                          	 
		if (!(request instanceof HttpServletRequest) || !(response instanceof HttpServletResponse)) {
			throw new ServletException("OncePerRequestFilter just supports HTTP requests");
		}
		HttpServletRequest httpRequest = (HttpServletRequest) request;
		HttpServletResponse httpResponse = (HttpServletResponse) response;
		String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
		if (request.getAttribute(alreadyFilteredAttributeName) != null || shouldNotFilter(httpRequest)) {
			// Proceed without invoking this filter...
			filterChain.doFilter(request, response);
		}
		else {
			// Do invoke this filter...
			request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
			try {
				doFilterInternal(httpRequest, httpResponse, filterChain);
			}
			finally {
				// Remove the "already filtered" request attribute for this request.
				request.removeAttribute(alreadyFilteredAttributeName);
			}
		}
}

This doFilter implementation stores a request attribute for "already filtered", proceeding without filtering again if the attribute is already there.

 abstract protected  void doFilterInternal(HttpServletRequest request,
    HttpServletResponse response,
    FilterChain filterChain) throws IOException, ServletException
Same contract as for doFilter, but guaranteed to be
just invoked once per request. Provides HttpServletRequest and
HttpServletResponse arguments instead of the default ServletRequest
and ServletResponse ones.

 protected String getAlreadyFilteredAttributeName() 
{
		String name = getFilterName();
		if (name == null) {
			name = getClass().getName();
		}
		return name + ALREADY_FILTERED_SUFFIX;
}

Return the name of the request attribute that identifies that a request is already filtered.

Default implementation takes the configured name of the concrete filter instance and appends ".FILTERED". If the filter is not fully initialized, it falls back to its class name.

 protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException 
{
		return false;
}

Can be overridden in subclasses for custom filtering control, returning true to avoid filtering of the given request.

The default implementation always returns false.