public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)

             throws ServletException, IOException {

         String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();

         if ( request.getAttribute(alreadyFilteredAttributeName) != null ) {

             log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", getName());

             filterChain.doFilter(request, response);

         } else //noinspection deprecation

             if (/* added in 1.2: */ !isEnabled(request, response) ||

                 /* retain backwards compatibility: */ shouldNotFilter(request) ) {

             log.debug("Filter '{}' is not enabled for the current request.  Proceeding without invoking this filter.",

                     getName());

             filterChain.doFilter(request, response);

         } else {

             // Do invoke this filter...

             log.trace("Filter '{}' not yet executed.  Executing now.", getName());

             request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);

             try {

                 doFilterInternal(request, response, filterChain); //保证客户端请求后该filter的doFilter只会执行一次。

             } finally {

                 // Once the request has finished, we're done and we don't

                 // need to mark as 'already filtered' any more.

                 request.removeAttribute(alreadyFilteredAttributeName);

             }

         }

     }

可以看出doFilter的实质内容是在doFilterInternal方法中完成的。
所以实质上是保证每一个filter的 doFilterInternal只会被执行一次，
例如在配置中 配置路径 /user/** = authc,authc.则只会执行authc中的doFilterInternal一次。
doFilterInternal非常重要，在shiro整个filter体系中的核心方法及实质入口。
另外，shiro是通过在request中设置一个该filter特定的属性值来保证该filter只会执行一次的。

其次可以看到有一个enabled属性，表示是否启用这个filter，默认是true，可以设置成false，
则会跳过这个filter的doFilterInternal方法而去执行filter链中其他filter。（filterChain.doFilter(request, response);放行）

 public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)

             throws ServletException, IOException {

         Exception exception = null;

         try {

             boolean continueChain = preHandle(request, response);

             if (log.isTraceEnabled()) {

                 log.trace("Invoked preHandle method.  Continuing chain?: [" + continueChain + "]");

             }

             if (continueChain) {

                 executeChain(request, response, chain); //doFilterInternal(request, response, filterChain);

             }

             postHandle(request, response);  //进入我们自己的方法逻辑，有点像 interceptor拦截器

             if (log.isTraceEnabled()) {

                 log.trace("Successfully invoked postHandle method");

             }

         } catch (Exception e) {

             exception = e;

         } finally {

             cleanup(request, response, exception);

         }

     }

PathMatchingFilter主要是对preHandle做进一步细化控制，该filter为抽象类，其他路径直接通过：preHandle中，
若请求的路径非该filter中配置的拦截路径，则直接返回true进行下一个filter。
若包含在此filter路径中，则会在isFilterChainContinued做一些控制，
该方法中会调用onPreHandle方法，
所以子类可以在onPreHandle中编写filter控制流程代码（返回true或false）。

 protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {

         if (this.appliedPaths == null || this.appliedPaths.isEmpty()) {

             if (log.isTraceEnabled()) {

                 log.trace("appliedPaths property is null or empty.  This Filter will passthrough immediately.");

             }

             return true;

         }

         for (String path : this.appliedPaths.keySet()) {

             // If the path does match, then pass on to the subclass implementation for specific checks

             //(first match 'wins'):

             if (pathsMatch(path, request)) {

                 log.trace("Current requestURI matches pattern '{}'.  Determining filter chain execution...", path);

                 Object config = this.appliedPaths.get(path);

                 return isFilterChainContinued(request, response, path, config);

             }

         }

         //no path matched, allow the request to go through:

         return true;

     }

  private boolean isFilterChainContinued(ServletRequest request, ServletResponse response,

                                            String path, Object pathConfig) throws Exception {

         if (isEnabled(request, response, path, pathConfig)) { //isEnabled check added in 1.2 点击在OncePerRequestFilter里头 默认true

             if (log.isTraceEnabled()) {

                 log.trace("Filter '{}' is enabled for the current request under path '{}' with config [{}].  " +

                         "Delegating to subclass implementation for 'onPreHandle' check.",

                         new Object[]{getName(), path, pathConfig});

             }

             //The filter is enabled for this specific request, so delegate to subclass implementations

             //so they can decide if the request should continue through the chain or not:

             return onPreHandle(request, response, pathConfig);

         }

         if (log.isTraceEnabled()) {

             log.trace("Filter '{}' is disabled for the current request under path '{}' with config [{}].  " +

                     "The next element in the FilterChain will be called immediately.",

                     new Object[]{getName(), path, pathConfig});

         }

         //This filter is disabled for this specific request,

         //return 'true' immediately to indicate that the filter will not process the request

         //and let the request/response to continue through the filter chain:

         return true;

     }

 protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {

         return true;

 }

AccessControlFilter中的对onPreHandle方法做了进一步细化，isAccessAllowed方法和onAccessDenied方法达到控制效果
。这两个方法都是抽象方法，由子类去实现。到这一层应该明白。isAccessAllowed和onAccessDenied方法会影响到onPreHandle方法，而onPreHandle方法会影响到preHandle方法，
而preHandle方法会达到控制filter链是否执行下去的效果。所以如果正在执行的filter中isAccessAllowed和onAccessDenied都返回false，
则整个filter控制链都将结束，不会到达目标方法（客户端请求的接口），而是直接跳转到某个页面（由filter定义的，将会在authc中看到）。