How deeply does Spring Security in Action, Second Edition cover @PostFilter?

Explains aspect-based interception, SpEL variables, supported return types, and repository performance limits.

@PostFilter

As explained in Spring Security in Action, Second Edition

@PostFilter is a Spring Security method annotation that filters a method's returned collection or array according to a Spring Expression Language authorization expression.

@PostFilter protects returned data after a method completes. Spring Security allows the method call, then filters its returned collection or array using a SpEL authorization expression. section 12.2

Apply @PostFilter with these constraints:

Return a collection or array; other return types are not supported by postfiltering. section 12.2 section 12.4
Write the authorization rule as the annotation value, using filterObject for each returned element and authentication for the current security context. section 12.2
Prefer database-level filtering for Spring Data repository queries; postfiltering can retrieve every record before filtering and cause memory or performance problems. section 12.3 section 12.4

Filter products by owner

Annotate a service method with @PostFilter("filterObject.owner == authentication.name"). A returned list containing products owned by nikolai and julien is reduced to the current user's products. Calling /find as julien returns chocolate; calling it as nikolai returns beer and candy.

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

filteringused by · Filtering is the operation of selecting or excluding items from data or a collection according to specified criteria.
Spring Expression Languageuses · Spring Expression Language is an expression language integrated with Spring for querying and manipulating object graphs and evaluating values, conditions, and configuration rules.
Spring Data repositoryuses · An interface-based abstraction for accessing persistent domain objects, whose interfaces may declare data-access operations supported or implemented by Spring Data.
query filteringalternative to · Query filtering is the enforcement of data-selection conditions within a database query so that unauthorized records are not retrieved.
@PostAuthorizecontrasts with · @PostAuthorize is a Spring Security annotation that evaluates an authorization expression after a method returns and can inspect or reject its result.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.