diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9dd26d92..80e75c70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,8 @@
 - Fix 4480: log format incorrect. [4482](https://github.com/beego/beego/pull/4482)
 - Remove `duration` from prometheus labels. [4391](https://github.com/beego/beego/pull/4391)
 - Fix `unknown escape sequence` in generated code. [4385](https://github.com/beego/beego/pull/4385)
+- Fix 4590: Forget to check URL when FilterChain invoke `next()`. [4593](https://github.com/beego/beego/pull/4593)
+- Fix 4727: CSS when request URI is invalid. [4729](https://github.com/beego/beego/pull/4729)
 - Using fixed name `commentRouter.go` as generated file name. [4385](https://github.com/beego/beego/pull/4385)
 - Fix 4383: ORM Adapter produces panic when using orm.RegisterModelWithPrefix. [4386](https://github.com/beego/beego/pull/4386)
 - Support 4144: Add new api for order by for supporting multiple way to query [4294](https://github.com/beego/beego/pull/4294)
@@ -37,6 +39,7 @@
 - Error Module brief design & using httplib module to validate this design. [4453](https://github.com/beego/beego/pull/4453)
 - Fix 4444: panic when 404 not found. [4446](https://github.com/beego/beego/pull/4446)
 - Fix 4435: fix panic when controller dir not found. [4452](https://github.com/beego/beego/pull/4452)
+- Hotfix:reflect.ValueOf(nil) in getFlatParams [4716](https://github.com/beego/beego/issues/4716)
 - Fix 4456: Fix router method expression [4456](https://github.com/beego/beego/pull/4456)
 - Remove some `go get` lines in `.travis.yml` file [4469](https://github.com/beego/beego/pull/4469)
 - Fix 4451: support QueryExecutor interface. [4461](https://github.com/beego/beego/pull/4461)
diff --git a/adapter/beego.go b/adapter/beego.go
index 08eb1e72..0c914241 100644
--- a/adapter/beego.go
+++ b/adapter/beego.go
@@ -40,7 +40,8 @@ type hookfunc func() error
 // The hookfuncs will run in beego.Run()
 // such as initiating session , starting middleware , building template, starting admin control and so on.
 func AddAPPStartHook(hf ...hookfunc) {
-	for _, f := range hf {
+	for i := 0; i < len(hf); i++ {
+		f := hf[i]
 		web.AddAPPStartHook(func() error {
 			return f()
 		})
diff --git a/adapter/namespace.go b/adapter/namespace.go
index 0a90c5c1..4beda252 100644
--- a/adapter/namespace.go
+++ b/adapter/namespace.go
@@ -38,7 +38,8 @@ func NewNamespace(prefix string, params ...LinkNamespace) *Namespace {
 
 func oldToNewLinkNs(params []LinkNamespace) []web.LinkNamespace {
 	nps := make([]web.LinkNamespace, 0, len(params))
-	for _, p := range params {
+	for i := 0; i < len(params); i++ {
+		p := params[i]
 		nps = append(nps, func(namespace *web.Namespace) {
 			p((*Namespace)(namespace))
 		})
@@ -81,7 +82,8 @@ func (n *Namespace) Filter(action string, filter ...FilterFunc) *Namespace {
 
 func oldToNewFilter(filter []FilterFunc) []web.FilterFunc {
 	nfs := make([]web.FilterFunc, 0, len(filter))
-	for _, f := range filter {
+	for i := 0; i < len(filter); i++ {
+		f := filter[i]
 		nfs = append(nfs, func(ctx *context.Context) {
 			f((*adtContext.Context)(ctx))
 		})
diff --git a/client/orm/orm.go b/client/orm/orm.go
index a72f07cf..47e46400 100644
--- a/client/orm/orm.go
+++ b/client/orm/orm.go
@@ -536,7 +536,6 @@ func (o *orm) BeginWithCtxAndOpts(ctx context.Context, opts *sql.TxOptions) (TxO
 			db:    &TxDB{tx: tx},
 		},
 	}
-
 	var taskTxOrm TxOrmer = _txOrm
 	return taskTxOrm, nil
 }
diff --git a/core/logs/console.go b/core/logs/console.go
index 849e9c6e..ff4fcf46 100644
--- a/core/logs/console.go
+++ b/core/logs/console.go
@@ -62,8 +62,7 @@ func (c *consoleWriter) Format(lm *LogMsg) string {
 		msg = strings.Replace(msg, levelPrefix[lm.Level], colors[lm.Level](levelPrefix[lm.Level]), 1)
 	}
 	h, _, _ := formatTimeHeader(lm.When)
-	bytes := append(append(h, msg...), '\n')
-	return string(bytes)
+	return string(append(h, msg...))
 }
 
 func (c *consoleWriter) SetFormatter(f LogFormatter) {
diff --git a/core/logs/console_test.go b/core/logs/console_test.go
index 02bff3ec..3ba932ab 100644
--- a/core/logs/console_test.go
+++ b/core/logs/console_test.go
@@ -76,7 +76,7 @@ func TestFormat(t *testing.T) {
 		Prefix:     "Cus",
 	}
 	res := log.Format(lm)
-	assert.Equal(t, "2020/09/19 20:12:37.000 \x1b[1;44m[D]\x1b[0m Cus Hello, world\n", res)
+	assert.Equal(t, "2020/09/19 20:12:37.000 \x1b[1;44m[D]\x1b[0m Cus Hello, world", res)
 	err := log.WriteMsg(lm)
 	assert.Nil(t, err)
 }
diff --git a/server/web/admin.go b/server/web/admin.go
index f5a1afc8..66ba3396 100644
--- a/server/web/admin.go
+++ b/server/web/admin.go
@@ -80,22 +80,15 @@ type adminApp struct {
 	*HttpServer
 }
 
-// Route adds http.HandlerFunc to adminApp with url pattern.
+// Run start Beego admin
 func (admin *adminApp) Run() {
-	// if len(task.AdminTaskList) > 0 {
-	// 	task.StartTask()
-	// }
-	logs.Warning("now we don't start tasks here, if you use task module," +
+	logs.Debug("now we don't start tasks here, if you use task module," +
 		" please invoke task.StartTask, or task will not be executed")
-
 	addr := BConfig.Listen.AdminAddr
-
 	if BConfig.Listen.AdminPort != 0 {
 		addr = fmt.Sprintf("%s:%d", BConfig.Listen.AdminAddr, BConfig.Listen.AdminPort)
 	}
-
 	logs.Info("Admin server Running on %s", addr)
-
 	admin.HttpServer.Run(addr)
 }
 
diff --git a/server/web/admin_test.go b/server/web/admin_test.go
index 60c067b0..57aa0fe6 100644
--- a/server/web/admin_test.go
+++ b/server/web/admin_test.go
@@ -29,7 +29,6 @@ func (cc *SampleCacheCheck) Check() error {
 func TestList_01(t *testing.T) {
 	m := make(M)
 	list("BConfig", BConfig, m)
-	t.Log(m)
 	om := oldMap()
 	for k, v := range om {
 		if fmt.Sprint(m[k]) != fmt.Sprint(v) {
@@ -98,8 +97,6 @@ func oldMap() M {
 }
 
 func TestWriteJSON(t *testing.T) {
-	t.Log("Testing the adding of JSON to the response")
-
 	w := httptest.NewRecorder()
 	originalBody := []int{1, 2, 3}
 
diff --git a/server/web/config.go b/server/web/config.go
index a85793be..6bddfe4a 100644
--- a/server/web/config.go
+++ b/server/web/config.go
@@ -405,6 +405,11 @@ type SessionConfig struct {
 	// the default value is http.SameSiteDefaultMode
 	// @Default 1
 	SessionCookieSameSite http.SameSite
+
+	// SessionIDPrefix
+	// @Description session id's prefix
+	// @Default ""
+	SessionIDPrefix string
 }
 
 // LogConfig holds Log related config
diff --git a/server/web/filter_chain_test.go b/server/web/filter_chain_test.go
index d102a9c8..d3faf516 100644
--- a/server/web/filter_chain_test.go
+++ b/server/web/filter_chain_test.go
@@ -27,7 +27,7 @@ import (
 	"github.com/beego/beego/v2/server/web/context"
 )
 
-func TestControllerRegister_InsertFilterChain(t *testing.T) {
+func TestControllerRegisterInsertFilterChain(t *testing.T) {
 	InsertFilterChain("/*", func(next FilterFunc) FilterFunc {
 		return func(ctx *context.Context) {
 			ctx.Output.Header("filter", "filter-chain")
@@ -80,3 +80,57 @@ func TestControllerRegister_InsertFilterChain_Order(t *testing.T) {
 
 	assert.True(t, st > ft)
 }
+
+func TestFilterChainRouter(t *testing.T) {
+	app := NewHttpSever()
+	const filterNonMatch = "filter-chain-non-match"
+	app.InsertFilterChain("/app/nonMatch/before/*", func(next FilterFunc) FilterFunc {
+		return func(ctx *context.Context) {
+			ctx.Output.Header("filter", filterNonMatch)
+			next(ctx)
+		}
+	})
+
+	const filterAll = "filter-chain-all"
+	app.InsertFilterChain("/*", func(next FilterFunc) FilterFunc {
+		return func(ctx *context.Context) {
+			ctx.Output.Header("filter", filterAll)
+			next(ctx)
+		}
+	})
+
+	app.InsertFilterChain("/app/nonMatch/after/*", func(next FilterFunc) FilterFunc {
+		return func(ctx *context.Context) {
+			ctx.Output.Header("filter", filterNonMatch)
+			next(ctx)
+		}
+	})
+
+	app.InsertFilterChain("/app/match/*", func(next FilterFunc) FilterFunc {
+		return func(ctx *context.Context) {
+			ctx.Output.Header("match", "yes")
+			next(ctx)
+		}
+	})
+
+	app.Handlers.Init()
+
+	r, _ := http.NewRequest("GET", "/app/match", nil)
+	w := httptest.NewRecorder()
+
+	app.Handlers.ServeHTTP(w, r)
+	assert.Equal(t, filterAll, w.Header().Get("filter"))
+	assert.Equal(t, "yes", w.Header().Get("match"))
+
+	r, _ = http.NewRequest("GET", "/app/match1", nil)
+	w = httptest.NewRecorder()
+	app.Handlers.ServeHTTP(w, r)
+	assert.Equal(t, filterAll, w.Header().Get("filter"))
+	assert.NotEqual(t, "yes", w.Header().Get("match"))
+
+	r, _ = http.NewRequest("GET", "/app/nonMatch", nil)
+	w = httptest.NewRecorder()
+	app.Handlers.ServeHTTP(w, r)
+	assert.Equal(t, filterAll, w.Header().Get("filter"))
+	assert.NotEqual(t, "yes", w.Header().Get("match"))
+}
diff --git a/server/web/hooks.go b/server/web/hooks.go
index 0f72e711..68cc61a1 100644
--- a/server/web/hooks.go
+++ b/server/web/hooks.go
@@ -62,6 +62,7 @@ func registerSession() error {
 			conf.SessionNameInHTTPHeader = BConfig.WebConfig.Session.SessionNameInHTTPHeader
 			conf.EnableSidInURLQuery = BConfig.WebConfig.Session.SessionEnableSidInURLQuery
 			conf.CookieSameSite = BConfig.WebConfig.Session.SessionCookieSameSite
+			conf.SessionIDPrefix = BConfig.WebConfig.Session.SessionIDPrefix
 		} else {
 			if err = json.Unmarshal([]byte(sessionConfig), conf); err != nil {
 				return err
diff --git a/server/web/router.go b/server/web/router.go
index 35bc506f..c4400b20 100644
--- a/server/web/router.go
+++ b/server/web/router.go
@@ -196,7 +196,10 @@ func (p *ControllerRegister) Init() {
 	for i := len(p.filterChains) - 1; i >= 0; i-- {
 		fc := p.filterChains[i]
 		root := p.chainRoot
-		filterFunc := fc.chain(root.filterFunc)
+		filterFunc := fc.chain(func(ctx *beecontext.Context) {
+			var preFilterParams map[string]string
+			root.filter(ctx, p.getUrlPath(ctx), preFilterParams)
+		})
 		p.chainRoot = newFilterRouter(fc.pattern, filterFunc, fc.opts...)
 		p.chainRoot.next = root
 	}
@@ -332,7 +335,6 @@ func (p *ControllerRegister) Include(cList ...ControllerInterface) {
 				for _, f := range a.Filters {
 					p.InsertFilter(f.Pattern, f.Pos, f.Filter, WithReturnOnOutput(f.ReturnOnOutput), WithResetParams(f.ResetParams))
 				}
-
 				p.addWithMethodParams(a.Router, c, a.MethodParams, WithRouterMethods(c, strings.Join(a.AllowHTTPMethods, ",")+":"+a.Method))
 			}
 		}
@@ -786,7 +788,7 @@ func (p *ControllerRegister) InsertFilter(pattern string, pos int, filter Filter
 //     }
 // }
 func (p *ControllerRegister) InsertFilterChain(pattern string, chain FilterChain, opts ...FilterOpt) {
-	opts = append(opts, WithCaseSensitive(p.cfg.RouterCaseSensitive))
+	opts = append([]FilterOpt{WithCaseSensitive(p.cfg.RouterCaseSensitive)}, opts...)
 	p.filterChains = append(p.filterChains, filterChainConfig{
 		pattern: pattern,
 		chain:   chain,
diff --git a/server/web/statistics.go b/server/web/statistics.go
index 74708cbd..d0f3ebd9 100644
--- a/server/web/statistics.go
+++ b/server/web/statistics.go
@@ -16,6 +16,7 @@ package web
 
 import (
 	"fmt"
+	"html/template"
 	"sync"
 	"time"
 
@@ -97,7 +98,7 @@ func (m *URLMap) GetMap() map[string]interface{} {
 	for k, v := range m.urlmap {
 		for kk, vv := range v {
 			result := []string{
-				fmt.Sprintf("% -50s", k),
+				fmt.Sprintf("% -50s", template.HTMLEscapeString(k)),
 				fmt.Sprintf("% -10s", kk),
 				fmt.Sprintf("% -16d", vv.RequestNum),
 				fmt.Sprintf("%d", vv.TotalTime),