Q:

Filter some methods of servlet

I need to apply an authentication filter to just some methods of servlets. The filter checks the validity of a JWT passed as a header key in the request.
For example, the session endpoint has a POST (log in, public) and a DELETE (log out, needs auth) method. Maybe I can split this two into a logout and login servlet but in the case I have resource endpoints that need auth to POST (create) and don't need auth to GET, a filter is impossible to apply and creating two separate servlets for each method is a pain to manage in a large scale app.
Is there a solution to this by just using servlets without any framework?
Apart from this, in the case I would apply the filter to "/secure" path, isn't this really user unfriendly? (To access a url that says "secure" or "public").

A:

I ended up creating a method addPublicFilter() that applies  the filterPublicFilter to the path and methods you pass as arguments.
public class PublicFilter implements Filter {

    private FilterConfig filterConfig;
    public static final String PUBLIC_METHODS = "com.example.access.PUBLIC_METHODS";
    static final String IS_PUBLIC = "com.example.access.IS_PUBLIC";

    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        final List<String> allowedMethods = Arrays.asList(filterConfig.getInitParameter(PUBLIC_METHODS).split(","));
        final String method = ((HttpServletRequest) request).getMethod();

        if (allowedMethods.contains(method)) request.setAttribute(IS_PUBLIC, true);
        chain.doFilter(request, response);
    }

    public void destroy() {}
}

Then in Jetty I have the method:
private static void addPublicFilter(ServletContextHandler context, String path, String publicMethods) {
    final FilterHolder holder = new FilterHolder(PublicFilter.class);
    holder.setInitParameter(PublicFilter.PUBLIC_METHODS, publicMethods);
    context.addFilter(holder, path, EnumSet.of(DispatcherType.REQUEST));
}

And I call it:
addPublicFilter(context, "/*", "OPTIONS");
addPublicFilter(context, "/user/*", "POST");
addPublicFilter(context, "/session", "POST,GET");

