code: @Override
      public void doMessageReceived(NextFilter nextFilter, IoSession session, Object message) throws Exception {
          // GL.debug("http", getClass().getSimpleName() + " request received.");
  
          if (! httpRequestMessageReceived(nextFilter, session, message)) return;
  
          HttpRequestMessage httpRequest = (HttpRequestMessage) message;
  
          // Make sure we start with the subject from the underlying transport session in case it already has an authenticated subject
          // (e.g. we are httpxe and our transport is http or transport is SSL with a client certificate)
          if (httpRequest.getSubject() == null) {
              httpRequest.setSubject( ((IoSessionEx)session).getSubject() );
          }
  
          ResourceAddress httpAddress = httpRequest.getLocalAddress();
          HttpRealmInfo[] realms = httpAddress.getOption(HttpResourceAddress.REALMS);
          if (realms.length == 0) {
              ResultAwareLoginContext loginContext = null;
              // Make sure we propagate the login context from the layer below in httpxe case
              if (session instanceof DefaultHttpSession) {
                  loginContext = ((DefaultHttpSession)session).getLoginContext();
              }
              if (loginContext != null) {
                  httpRequest.setLoginContext(loginContext);
              }
              else {
                  setUnprotectedLoginContext(httpRequest);
              }
  
              final boolean loggerIsEnabled = logger != null && logger.isTraceEnabled();
              if (loggerIsEnabled) {
                  logger.trace("HttpSubjectSecurityFilter skipped because no realm is configured.");
              }
              super.doMessageReceived(nextFilter, session, message);
              return;
          }
  
          securityMessageReceived(nextFilter, session, httpRequest);
      }
docs: Security code for subject-security LEGACY