Spring Security - Third Edition

Practical considerations for annotation-based security

One thing to consider is that when returning a collection of real-world applications, there is likely to be some sort of paging. This means that our @PreFilter and @PostFilter annotations cannot be used as the sole means of selecting which objects to return. Instead, we need to ensure that our queries only select the data that the user is allowed to access. This means that the security annotations become redundant checks. However, it is important to remember our lesson at the beginning of this chapter; we want to secure layers in case one layer is able to be bypassed.