I think I found the answer. Cloud AEM offers no way to see the filter order, everything is blocked.
Locally, if you run publisher and hit this URL logging in with admin/admin:
http://localhost:4503/system/console/status-slingfilter
you get this list:
Request Filters:
2147483647 : class com.adobe.granite.resourceresolverhelper.impl.ResourceResolverHelperImpl (id: 1292, property: service.ranking=2147483647); called: 23; time: 0ms; time/call: 0µs
2147483647 : class org.apache.sling.distribution.servlet.DistributionAgentCreationFilter (id: 3783, property: service.ranking=2147483647); called: 0; time: 208ms; time/call: -1µs
25000 : class org.apache.sling.security.impl.ContentDispositionFilter (id: 628, property: service.ranking=25000); called: 23; time: 527ms; time/call: 22913µs
25000 : class com.adobe.granite.csrf.impl.CSRFFilter (id: 1245, property: service.ranking=25000); called: 23; time: 414ms; time/call: 18000µs
10000 : class org.apache.sling.i18n.impl.I18NFilter (id: 4455, property: service.ranking=10000); called: 23; time: 500ms; time/call: 21739µs
5000 : class com.adobe.granite.httpcache.impl.InnerCacheFilter (id: 1213, property: service.ranking=5000); called: 23; time: 324ms; time/call: 14086µs
2500 : class org.apache.sling.rewriter.impl.RewriterFilter (id: 4525, property: service.ranking=2500); called: 23; time: 7222ms; time/call: 314000µs
2000 : class com.day.cq.wcm.core.impl.WCMRequestFilter (id: 2196, property: service.ranking=2000); called: 23; time: 188ms; time/call: 8173µs
1900 : class com.adobe.acs.commons.redirects.filter.RedirectFilter (id: 5751, property: service.ranking=1900); called: 23; time: 632ms; time/call: 27478µs
610 : class com.adobe.cq.wcm.core.components.internal.servlets.CoreFormHandlingServlet (id: 2254, property: service.ranking=610); called: 23; time: 136ms; time/call: 5913µs
600 : class com.adobe.granite.optout.impl.OptOutFilter (id: 1256, property: service.ranking=600); called: 23; time: 2378ms; time/call: 103391µs
600 : class com.day.cq.wcm.foundation.forms.impl.FormsHandlingServlet (id: 2255, property: service.ranking=600); called: 23; time: 97ms; time/call: 4217µs
Where the left number is the order/priority. However, dont know if lower or higher number gets run first.
