Chapter 12: Implementing filtering at the method level
The introduction explains how method-level filtering differs from call authorization, when prefiltering and postfiltering occur, and which parameter and return types they can filter.
After this chapter you will be able to
- Filtering versus call authorization. Distinguish method-level filtering from call authorization: filtering removes elements that violate a rule while allowing the method call, whereas call authorization allows or rejects the call as a whole.
- Prefiltering and postfiltering boundaries. Describe when prefiltering and postfiltering act and the parameter or return types to which each can apply.
- Prefiltering of method arguments. Explain how prefiltering changes the values a protected method receives.
- Product ownership filter expression. Describe how the example configures @PreFilter to let a user sell only products they own.
- Mutable input collection requirement. Explain why a collection passed to the prefiltered method must be mutable.
- Postfiltering of returned values. Explain how postfiltering applies authorization rules after a method returns, removing elements that do not satisfy those rules while keeping authorization separate from business logic.
- Product ownership filter rule. Describe how to annotate the product-list method so its result contains only products owned by the authenticated user, including what each side of the SpEL condition refers to and which return types support postfiltering.
- Repository Filtering Tradeoff. Explain why @PostFilter can work on a Spring Data repository method but is usually a poor choice when the repository can select only the needed records.
- Owner Restricted Repository Query. Describe how the example moves its owner restriction into a Spring Data repository query while preserving the product search behavior.
What it builds on
- Applying preauthorization rules (chapter 11) · Introduces preauthorization as a rule that can reject a method call.
- Applying postauthorization rules (chapter 11) · Introduces postauthorization as a rule that can reject a method call.
- Understanding call authorization (chapter 11) · Assumes familiarity with authorization applied to method calls.
- Enabling method security in your project (chapter 11) · Assumes method security can be enabled in a project.
Section by section
Introduction
The introduction explains how method-level filtering differs from call authorization, when prefiltering and postfiltering occur, and which parameter and return types they can filter.
- Filtering versus call authorization: Distinguish method-level filtering from call authorization: filtering removes elements that violate a rule while allowing the method call, whereas call authorization allows or rejects the call as a whole.
Why it matters: This distinction helps you choose whether a rule should reject a call or remove unauthorized elements. - Prefiltering and postfiltering boundaries: Describe when prefiltering and postfiltering act and the parameter or return types to which each can apply.
Why it matters: The timing and type restrictions determine whether filtering fits a method’s inputs or output.
Key terms: filtering, call authorization, @PreAuthorize, @PostAuthorize, prefiltering, postfiltering, collections, arrays
12.1 Applying prefiltering for method authorization
This section explains how Spring Security filters method arguments before a method runs, demonstrates an ownership rule with @PreFilter, and shows why the input collection must be mutable.
- Prefiltering of method arguments: Explain how prefiltering changes the values a protected method receives.
Why it matters: It lets you describe what the protected method actually receives, rather than just what its caller supplies. - Authorization outside business logic: Justify applying an ownership filter at the protected method rather than relying on each caller or mixing the rule into the method's business logic.
Why it matters: The ownership rule remains with the use case even when it is invoked from multiple places. - Product ownership filter expression: Describe how the example configures @PreFilter to let a user sell only products they own.
Why it matters: The expression shows how to turn a user's identity into a per-product filtering rule. - Mutable input collection requirement: Explain why a collection passed to the prefiltered method must be mutable.
Why it matters: Using an immutable input can make an otherwise valid filter rule fail when the method is called.
Key terms: prefiltering, aspect, @PreFilter, authorization rules, business logic, authenticated user, @EnableMethodSecurity, SpEL, filterObject, authentication.name
12.2 Applying postfiltering for method authorization
The section explains how postfiltering removes unauthorized items from a method’s returned collection, then applies it to products owned by the authenticated user.
- Postfiltering of returned values: Explain how postfiltering applies authorization rules after a method returns, removing elements that do not satisfy those rules while keeping authorization separate from business logic.
Why it matters: Filtering the result lets a method retrieve products without exposing products the caller is not allowed to see. - Product ownership filter rule: Describe how to annotate the product-list method so its result contains only products owned by the authenticated user, including what each side of the SpEL condition refers to and which return types support postfiltering.
Why it matters: The rule makes the returned product list appropriate for the user making the request.
Key terms: postfiltering, aspect, returned collection, @PostFilter, SpEL, filterObject, authentication, SecurityContext
12.3 Using filtering in Spring Data repositories
This section compares filtering Spring Data repository results in the application with restricting the repository query so the database returns only authorized records.
- Repository Filtering Tradeoff: Explain why @PostFilter can work on a Spring Data repository method but is usually a poor choice when the repository can select only the needed records.
Why it matters: Filtering at the query can avoid unnecessary database reads, application-side work, and memory pressure. - Owner Restricted Repository Query: Describe how the example moves its owner restriction into a Spring Data repository query while preserving the product search behavior.
Why it matters: The query keeps the same user-visible restriction while avoiding retrieval of other owners' products.
Key terms: @PostFilter, @PreFilter, Spring Data repositories, SecurityEvaluationContextExtension, SpEL, WHERE clause, ProductRepository, authenticated user
12.4 Summary
Where this is used later
- Testing method security (chapter 18) · Provides method-security behavior that can be checked in tests.
Concepts explained in this chapter
- filteringFiltering is a method-security technique that restricts method input parameters or returned results according to authorization rules.
- @PreFilter@PreFilter is a Spring Security annotation that filters elements of a method input collection or array by evaluating an authorization expression before method invocation.
- postfilteringPostfiltering is filtering applied to a method's returned data before the caller receives it.
- @PostFilter@PostFilter is a Spring Security method annotation that filters a method's returned collection or array according to a Spring Expression Language authorization expression.
- prefilteringPrefiltering is filtering applied to a method's input parameters before the method receives them.
- query filteringDatabase-level filtering is the application of selection criteria within a database query so that only permitted records are returned.
- SQLA database query is a structured request to retrieve or modify data in a database.
- SecurityEvaluationContextExtensionSecurityEvaluationContextExtension is a Spring Security extension that exposes security evaluation context information to Spring Expression Language expressions used by data queries.
- Spring Data repositoryA Spring Data repository is an interface-based abstraction that provides data-access operations for an underlying data store.
- aspectAn aspect is a modular unit that encapsulates behavior applied across selected program execution points, commonly by intercepting method calls.
← Chapter 11: Implementing authorization at the method level
Chapter 13: What are OAuth 2 and OpenID Connect? →
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.