在 Spring Security 中，可以通過自定義過濾器來實現自定義的過濾規則。以下是實現自定義過濾器的步驟：

1. 創建自定義過濾器類

首先需要創建一個自定義過濾器類，該類需要繼承 org.springframework.web.filter.GenericFilterBean 類，并重寫 doFilter 方法。在 doFilter 方法中，可以實現自己的過濾邏輯。

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.GenericFilterBean;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class CustomFilter extends GenericFilterBean {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;

        // 自定義過濾邏輯
        String customHeader = httpRequest.getHeader("X-Custom-Header");
        if (customHeader != null && customHeader.equals("custom-value")) {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            if (authentication == null || !authentication.isAuthenticated()) {
                HttpServletResponse httpResponse = (HttpServletResponse) response;
                httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
                return;
            }
        }

        // 繼續執行后續過濾器
        chain.doFilter(request, response);
    }
}

2. 配置自定義過濾器

接下來需要在 Spring Security 配置類中配置自定義過濾器。首先需要創建一個 HttpSecurity 對象，然后調用 authorizeRequests 方法配置過濾規則，最后調用 addFilterBefore 或 addFilterAfter 方法將自定義過濾器添加到過濾器鏈中的指定位置。

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .addFilterBefore(new CustomFilter(), BasicAuthenticationFilter.class); // 將自定義過濾器添加到 BasicAuthenticationFilter 之前
    }
}

在上面的示例中，我們將自定義過濾器 CustomFilter 添加到了 BasicAuthenticationFilter 之前。可以根據需要將其添加到過濾器鏈中的其他位置。