Spring Security in Action

17 Global method security: Pre- and postfiltering

This chapter covers

• Using prefiltering to restrict what a method receives as parameter values

• Using postfiltering to restrict what a method returns

• Integrating filtering with Spring Data

In chapter 16, you learned how to apply authorization rules using global method security. We worked on examples using the @PreAuthorize and @PostAuthorize annotations. By using these annotations, you apply an approach in which the application either allows the method call or it completely rejects the call. Suppose you don’t want to forbid the call to a method, but you want to make sure that the parameters sent to it follow some rules. Or, in another scenario, you want to make sure that after someone ...