The Power of Pluggability
The Filter Chain is the brain of Envoy. It is an implementation of the classic "Chain of Responsibility" design pattern: each filter in the chain either processes the request and passes it along, or short-circuits the chain and returns a response immediately. This lets you compose complex behaviors from simple, independent building blocks — without changing any application code.
If any filter in the middle says "Reject" — for example, the auth filter finds an invalid JWT — the chain stops immediately and returns a 403 Forbidden. The request never reaches your application container. This is a critical security property: the mesh enforces policy at the proxy layer, not inside application code.
Filter Ordering Matters
Filters execute in the order they are declared. A common mistake is placing a rate-limiting filter before an authentication filter — meaning unauthenticated requests consume rate-limit quota before being rejected. The correct order is always: authenticate first, then authorize, then rate-limit, then route.