我的过滤器怎么没有过滤效果

过滤器代码

package com.book.mlibrary.filter;

import com.book.mlibrary.entity.User;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebFilter(filterName = "AuthFilter",urlPatterns = "/*")
public class AuthFilter implements Filter {
    public void destroy() {
    }

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
        HttpServletRequest request = (HttpServletRequest)req;
        HttpServletResponse response = (HttpServletResponse)resp;
        User existUser = (User)request.getSession().getAttribute("existUser");
        String requestURI = request.getRequestURI();
        System.out.println(requestURI);
        boolean flag = false;
        //不需要过滤的url
        String[] urls = {"/login",".html",".js",".css",".ico",".jpg",".png"};
        for (String str :
                urls) {
            if (requestURI.indexOf(str) != -1) {
                flag = true;
                break;
            }
        }
        if (flag) {
            chain.doFilter(request, response);
        } else {
            if (existUser != null) {
                chain.doFilter(request, response);
            } else {
                request.getRequestDispatcher("/WEB-INF/jsp/login.jsp").forward(request, response);
            }
        }


    }

    public void init(FilterConfig config) throws ServletException {

    }

}

登录控制器LoginController代码

package com.book.mlibrary.controller;

import com.book.mlibrary.entity.User;
import com.book.mlibrary.service.UserServiceImpl;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.util.List;

@WebServlet(name = "LoginController",urlPatterns = "/login")
public class LoginController extends HttpServlet {
    private UserServiceImpl userService = new UserServiceImpl();

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        doGet(request,response);
    }

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        List<User> userList = (List<User>) request.getServletContext().getAttribute("userList");
        HttpSession session = request.getSession();
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        User user = new User();
        user.setUsername(username);
        user.setPassword(password);
        int login = userService.login(userList, user);
        if (login == 1) {
            session.setAttribute("existUser", user);
        } else {
            session.setAttribute("existUser",null);
        }
        request.getRequestDispatcher("WEB-INF/jsp/categoryList.jsp").forward(request,response);
        System.out.println(session.getAttribute("existUser"));
    }
}

麻烦老师康康~