My opinion on this has changed significantly. It seems to be ok to just invoke one blocking filter. In the Servlet spec in "6.2.1 Filter Lifecycle" in the point 4 there is this:

The filter may invoke the next entity in the filter chain. The next entity may be
another filter, or if the filter making the invocation is the last filter configured in the
deployment descriptor for this chain, the next entity is the target Web resource. The
invocation of the next entity is effected by calling the doFilter method on the
FilterChain object, and passing in the request and response with which it was
called or passing in wrapped versions it may have created.

The filter chain’s implementation of the doFilter method, provided by the
container, must locate the next entity in the filter chain and invoke its doFilter
method, passing in the appropriate request and response objects.

Alternatively, the filter chain can block the request by not making the call to invoke
the next entity, leaving the filter responsible for filling out the response object.