code: public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
              throws IOException, ServletException {
  
          final HttpServletRequest req = (HttpServletRequest) request;
          final HttpServletResponse res = (HttpServletResponse) response;
  
          final String requestUri = req.getRequestURI();
          if (requestUri != null) {
              boolean allowed = false;
              for (final String url: allowUrls) {
                  if (requestUri.equals("/")) {
                      if (url.trim().equals("/")) {
                          allowed = true;
                      }
                  } else if (requestUri.startsWith(url.trim())) {
                      allowed = true;
                  }
              }
              if (!allowed) {
                  res.setStatus(HttpServletResponse.SC_NOT_FOUND);
                  return;
              }
          }
          chain.doFilter(request, response);
      }
docs: Check for allowed URLs being requested.
  
  @param request The request object.
  @param response The response object.
  @param chain Refers to the {@code FilterChain} object to pass control to the next {@code Filter}.
  @throws IOException a IOException
  @throws ServletException a ServletException