If checking whether the user is logged in by any specific cookie or session info, it is okay, but for initial login authentication, which should be specific to each application and essentially login is part of functionality, so initial authentication need not be done in filters. Once cleared, thereby you can intercept every request, and see whether user is authenticated.