フィルタは静的ファイルへの直接アクセスを禁止します

 HttpServletRequest req = (HttpServletRequest) request;
 HttpServletResponse res = (HttpServletResponse) response;
 String uri = req.getRequestURI();

if (uri.indexOf("/css/") != -1
                && req.getHeader("referer") == null) {
            res.sendError(HttpServletResponse.SC_FORBIDDEN);
}