Why does OncePerRequestFilter execute on permitAll() endpoints even when added via addFilterBefore in a SecurityFilterChain?

I have a Spring Security configuration with a SecurityFilterChain that uses authorizeHttpRequests to permit certain endpoints like /user/register without authentication. However I also have a custom JWT filter added via addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class) which still executes on those permitAll() endpoints and throws a JWTDecodeException since there is no token present on public endpoints like register and login. I fixed this by adding shouldNotFilter() to my OncePerRequestFilter to explicitly skip those paths, but I don’t fully understand why this is necessa