Filter有要實現的三方法：
void init(FilterConfig config) throws ServletException
void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
void destroy()
第一個方法，Filter被加載時，首先執行這個方法，常用來做些初始化的動作。
第二個方法，Filter處理過程的方法，最后一個參數chain，則是把request,response傳給下一個Filter的FilterChain 對象，FilterChain是用doFilter()方法來調用下一個Filter，或者當沒有Filter可調用時，則調用原始的Servlet等網頁部分。

其次需要在Web.xml中設定Filter類和對應的網頁類別。

下面是一個用Filter來對請求做統一的認證處理（參《jsp2.0技術手冊》）

public class SessionCheckerFilter implements Filter{
    private final Log logger = LogFactory.getLog(getClass());
    private ServletContext context;
    private String targetURI;
    private String loginChecker;

    /* (non-Javadoc)
     * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
     */
    public void init(FilterConfig config) throws ServletException {
       context = config.getServletContext();
       targetURI = config.getInitParameter("TargetURI");
       loginChecker = config.getInitParameter("loginChecker");
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
     */
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // TODO Auto-generated method stub
        LoginUserPool loginUserPool = LoginUserPool.getInstance();
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        HttpSession session = httpRequest.getSession(false);
        if(session != null){
            String passed = (String) session.getAttribute("passed");

                if(passed.equals("true")){
                    chain.doFilter(httpRequest,httpResponse);
                    return;
                }else if(passed.equals("passing")){
                    if(new String(httpRequest.getRequestURI()).equals(httpRequest.getContextPath()+"/"+loginChecker)){
                        chain.doFilter(httpRequest,httpResponse);
                        return;
                    }
                }
            session.removeAttribute("passed");
        }
        StringBuffer requestURL = httpRequest.getRequestURL();
        String query = httpRequest.getQueryString();
        if(query != null){
            requestURL.append(query);
        }
        httpRequest.setAttribute("originalURI",new String(requestURL));
        httpRequest.getRequestDispatcher(targetURI).forward(httpRequest,httpResponse);
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#destroy()
     */
    public void destroy() {
        // TODO Auto-generated method stub
        
    }

public class LoginChecker extends HttpServlet{
    private final Log logger = LogFactory.getLog(getClass());
    protected void doPost(
            HttpServletRequest httpRequest,
            HttpServletResponse httpResponse) throws IOException, ServletException {
            logger.info("Servlet:用戶登陸合法性判斷");
            String userId = httpRequest.getParameter("userId");
            String password = httpRequest.getParameter("password");
            String targetURI = httpRequest.getParameter("originalURI");
            if ((!userId.equals("admin")) || (!password.equals("1234"))) {
                throw new ServletException("粄靡ア毖");
            }
            
            HttpSession session = httpRequest.getSession();
            session.setAttribute("passed", "true");
            httpResponse.sendRedirect(targetURI);
        }

 }

<%@ page contentType="text/html;charset=Big5" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<html>
<head>
  <title>CH11 - Login.jsp</title>
</head>
<body>

<h2></h2>
<h2>用戶名admin,密碼1234</h2>

<c:set var="passed" value="passing" scope="session" />
<form method="post" action="/JSPBook/LoginChecker">
  <table>
    <tr>
      <th>用戶名</th>
      <td><input type="text" name="userId"></td>
    </tr>
    <tr>
      <th>密碼</th>
      <td><input type="password" name="password"></td>
    </tr>
    <th><input type="hidden" name="originalURI" value="${requestScope.originalURI}"></th>
    
    <tr>
      <th><input name="submit" type="submit" value="確認"></th>
    </tr>
  </table>
</form>

</body>
</html>

<filter>     
      <filter-name>SessionChecker</filter-name>    
      <filter-class>tw.com.javaworld.CH11.SessionChecker</filter-class>    
      <init-param>
        <param-name>targetURI</param-name>        
        <param-value>/CH11/Login.jsp</param-value>    
      </init-param>
    </filter>
    <filter-mapping>    
      <filter-name>SessionChecker</filter-name>    
      <url-pattern>/*</url-pattern>
    </filter-mapping>
  
  <servlet>
        <servlet-name>LoginChecker</servlet-name>
        <servlet-class>tw.com.javaworld.CH11.LoginChecker</servlet-class>
    </servlet>    
    <servlet-mapping>
        <servlet-name>LoginChecker</servlet-name>
        <url-pattern>/LoginChecker</url-pattern>
    </servlet-mapping>

。

必須的話再做一些其它的過濾器，來判斷，用戶的合法性等等。