Prefiltering is filtering applied to a method's input parameters before the method receives them.
Prefiltering filters collection or array elements before a method receives them, allowing the method call to proceed with only authorized values rather than rejecting the call. section 12.0section 12.4
Apply prefiltering by:
Enabling method security with @EnableMethodSecurity. section 11.1
Annotating the method with @PreFilter and supplying a SpEL condition. section 12.1
Filtering products by owner
A service can declare @PreFilter("filterObject.owner == authentication.name") on sellProducts(List<Product> products). A request authenticated as nikolai receives only beer and candy; julien receives only chocolate. Replacing the mutable list with List.of causes an UnsupportedOperationException.
How Spring Security in Action, Second Edition covers it
How deep it goes
Explains aspect interception, @PreFilter SpEL expressions, collection constraints, and mutable-input behavior through runnable examples.
Examples
Demonstrates owner-filtered products through a /sell endpoint, curl requests, response lists, and an immutable-list failure.
What it assumes
Assumes basic Spring and Java, while introducing method-security enablement, aspects, SpEL, filterObject, and authentication references.
What you can do after
Apply it via Spring Security to restrict collection or array inputs before authorized service methods process them.
How it connects
Connects prefiltering with method security, call authorization, postfiltering, SpEL, authentication, and Spring Data.
$vectorSearchuses · $vectorSearch is a MongoDB aggregation pipeline stage that performs vector similarity search with optional filtering.
filteringkind of · Filtering is the operation of selecting or excluding items from data or a collection according to specified criteria.
vector indexconfigured by · A vector index is a data structure that organizes vector representations to support efficient similarity or nearest-neighbor search.
@PreFilterimplemented by · @PreFilter is a Spring Security annotation that filters elements of a method's input collection or array according to an authorization expression before execution.
immutable collectioncontrasts with · An immutable collection is a collection whose membership and contents cannot be changed after creation.
aspectimplemented by · An aspect is a modular unit of cross-cutting behavior applied around selected program operations or method invocations.
This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.
