Merge pull request #5449 from kenjis/fix-docs-filters.rst

docs: improve filters.rst

Author: kenjis

user_guide_src/source/incoming/filters.rst

@@ -91,6 +91,13 @@ Configuring Filters
 Once you've created your filters, you need to configure when they get run. This is done in **app/Config/Filters.php**.
 This file contains four properties that allow you to configure exactly when the filters run.
 
+.. Note:: The safest way to apply filters is to :ref:`disable auto-routing <use-defined-routes-only>`, and :ref:`set filters to routes <applying-filters>`.
+
+.. Warning:: It is recommended that you should always add ``*`` at the end of a URI in the filter settings.
+    Because a controller method might be accessible by different URLs than you think.
+    For example, when auto-routing is enabled, if you have ``Blog::index``,
+    it can be accessible with ``blog``, ``blog/index``, and ``blog/index/1``, etc.
+
 $aliases
 ========
 
@@ -133,7 +140,7 @@ run on every request. Filters can be specified by adding their alias to either t
 There are times where you want to apply a filter to almost every request, but have a few that should be left alone.
 One common example is if you need to exclude a few URI's from the CSRF protection filter to allow requests from
 third-party websites to hit one or two specific URI's, while keeping the rest of them protected. To do this, add
-an array with the 'except' key and a uri to match as the value alongside the alias::
+an array with the 'except' key and a URI to match as the value alongside the alias::
 
     public $globals = [
         'before' => [