Execution order of defined filters in undertow is inconsistent

Issue

• Undertow filter execution order ignored

• We have defined three different filters in the undertow subsystem (see full undertow subsystem config below):

  <filter-ref name="custom-proxy-filter"/> - custom Handler class to accept only requests from defined DNs
  <filter-ref name="eap-ssl-headers"/>  - EAP's standard ssl-headers handler
  <filter-ref name="gzipfilter"/>        - EAP's standard gzip filter
  

  It seems that the eap-ssl-headers is executed as first when the first request hitting undertow contains the ssl_client_cert header. If the first request does not contain the ssl_client_cert header, the custom-proxy-filter is executed as first. This differs from the behaviour in EAP 7.0.8 and EAP 6.4.x where the filters were executed in the configuration order

• EAP 7.0 Configuration Guide and EAP 7.0 Model Reference says the following description for the priority attribute of <filter-ref>. However, as far as I tested, it appears to be the opposite:

  priority - Defines filter order, it should be set to 1 or more, higher number 
  instructs server to be included earlier in handler chain than others under same context.