Okay, I didn’t get that the jersey.config.server.provider.packages
init param needs to reference not only service classes (API endpoints) but ALL the classes including filters.
Now it works :
<init-param>
<param-name>jersey.config.server.provider.packages</param-name>
<param-value>com.hck.debate.rest.controller;com.hck.debate.rest.security</param-value>
</init-param>
<init-param>
<param-name>com.sun.jersey.spi.container.ContainerRequestFilters</param-name>
<param-value>com.hck.debate.rest.security.AuthFilter</param-value>
</init-param>