Spring Security - Third Edition

Securing method data using role-based filtering

The two final Spring Security-dependent annotations are @PreFilter and @PostFilter, which are used to apply security-based filtering rules to collections or arrays (with @PostFilter only). This type of functionality is referred to as security trimming or security pruning and involves using the security credentials of principal at runtime to selectively remove members from a set of objects. As you might expect, this filtering is performed using SpEL expression notation within the annotation declaration.

We'll work through an example with JBCP calendar, as we want to filter the getEvents method to only return the events that this user is allowed to see. In order to do this, we remove any existing ...