I have 4 filters, in this order - SecurityFilter, HibernateFilterLong, JSF-Spring filter, myfaces ExtensionFilter.
Just a thought: are the filters really set up in web.xml in the right order? If you're mixing filter mappings by URL pattern with filter mappings by Servlet class name, then the order might not be what you expect - see the Servlet spec. on the Sun website.
Jeremy
