Aspect

As explained in Spring Security in Action, Second Edition

An aspect is a modular unit that encapsulates behavior applied across selected program execution points, commonly by intercepting method calls.

An aspect is a modular unit that intercepts selected method calls and adds behavior around them. In method security, it evaluates authorization rules before or after delegation and prevents unauthorized calls or results from reaching the caller. section 11.1.1

Spring Security uses aspects to separate authorization responsibilities from business logic:

• Preauthorization checks rules before the protected method executes and refuses delegation when they fail. section 11.1.1
• Postauthorization delegates the call, checks the result afterward, and prevents unauthorized values from returning. section 11.1.1
• Prefiltering intercepts a collection argument and removes values that fail an authorization expression before business processing. section 12.1

Filtering products before selling

A service method annotated with @PreFilter("filterObject.owner == authentication.name") receives only products owned by the authenticated user. The aspect changes the supplied mutable collection, leaving the service method focused on selling products. Immutable collections cause an UnsupportedOperationException. section 12.1

Figure 11.2 When we enable global method security, an aspect intercepts the call to the protected method. If the given authorization rules aren’t respected, the aspect doesn’t delegate the call to the protected method.

The interception flow shows how an aspect blocks an unauthorized method call instead of delegating to the protected method. section 11.1.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains interception, preauthorization, postauthorization, and prefiltering with execution flows and runnable examples.

Examples

Demonstrates protected document access, ownership-based product filtering, HTTP requests, and mutable versus immutable collections.

What it assumes

Assumes authenticated users, protected service methods, and basic familiarity with Spring Security method authorization.

What you can do after

Apply it via Spring Security to authorize method calls, check returned values, or filter collection arguments.

How it connects

Connects aspects with aspect-oriented programming, method security, authorization, SpEL, authentication, and filtering.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Go by ExampleInterceptor is a book-specific wrapper type that intercepts response-writing behavior while retaining access to the wrapped response writer.

Compare how 2 books explain aspect →

Related concepts

• Springused by · Spring Framework is an open-source Java application framework that provides infrastructure and programming models for building applications, including dependency injection, configuration, and web and data-access capabilities.
• postfilteringused by · Postfiltering is filtering applied to a method's returned data before the caller receives it.
• http.ResponseWriterkind of · http.ResponseWriter is the Go interface through which an HTTP handler constructs a response by writing its headers, status, and body.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.