Filtering controls which values cross a method boundary without rejecting the method call. It removes unauthorized elements from input collections before execution or from returned collections afterward. section 12.0 section 12.4
Apply filtering through two method-security annotations:
- @PreFilter removes elements from a collection or array parameter before the method runs. Its SpEL condition uses filterObject for each element. section 12.1 section 12.4
- @PostFilter removes elements from a collection or array returned after the method executes. section 12.0 section 12.4
- Enable method security explicitly with @EnableMethodSecurity before using these annotations. section 11.1
Filter products by owner
A product-selling service can accept products owned by the authenticated user while ignoring the rest: @PreFilter("filterObject.owner == authentication.name"). Given products owned by nikolai and julien, nikolai receives only beer and candy, while julien receives only chocolate. The intercepted collection must be mutable because the aspect changes it.
Figure 12.1 The client calls the endpoint providing a value that doesn’t follow the authorization rule. With preauthorization, the method isn’t called at all, and the caller receives an exception. With prefiltering, the aspect calls the method but only provides the values that follow the given rules.
Compare preauthorization, which rejects the call, with prefiltering, which calls the method using only values that satisfy the rule. section 12.0
Use filtering to keep authorization rules separate from business logic. For Spring Data repositories, prefer authorization conditions in database queries over postfiltering large result sets in application memory. section 12.1 section 12.3
