Postfiltering applies authorization after a method executes. The method call succeeds, but the framework removes unauthorized elements from its returned collection or array before the caller receives the result. Unlike postauthorization, it does not reject the entire call when some returned values violate the rule. section 12.0 section 12.2
Implement postfiltering by following these constraints:
- Enable method security, then annotate a method with @PostFilter. section 12.2
- Return a collection or array; postfiltering does not apply to a single returned object. section 12.0 section 12.4
- Write the authorization condition as a SpEL expression, using filterObject for each returned element and authentication for the security context. section 12.2
- Prefer database-level conditions for repository queries instead of loading a large result set and filtering it in application memory. section 12.3
Returning only the caller's products
A service can expose @PostFilter("filterObject.owner == authentication.name") on findProducts(), which returns products owned by different users. A request authenticated as julien receives only chocolate; a request authenticated as nikolai receives beer and candy. For a Spring Data repository, move the ownership condition into the query with authentication.name so the data source returns only authorized records. section 12.2 section 12.3
Figure 12.7 Postfiltering. An aspect intercepts the collection returned by the protected method and filters the values that don’t follow the rules you provide. Unlike postauthorization, postfiltering doesn’t throw an exception to the caller when the returned value doesn’t follow the authorization rules.
Shows the aspect intercepting a returned collection, removing values that fail the rule, and avoiding the exception produced by postauthorization. section 12.2
