Spring Security – @PreFilter and @PostFilter – Spring Security – @PreFilter 和 @PostFilter

最后修改: 2016年 12月 16日


1. Overview


In this article, we’ll learn how to use the @PreFilter and @PostFilter annotations to secure operations in a Spring application.


When used together with the authenticated principal information, @PreFilter and @PostFilter allows us to define fine-grained security rules using Spring Expression Language.


2. Introducing @PreFilter and @PostFilter


Simply put, the @PreFilter and @PostFilter annotations are used to filter lists of objects based on custom security rules we define.


@PostFilter defines a rule for filtering the return list of a method, by applying that rule to every element in the list. If the evaluated value is true, the item will be kept in the list. Otherwise, the item will be removed.


@PreFilter works in a very similar fashion, however, the filtering is applied to a list that is being passed as an input parameter to the annotated method.


Both annotations can be used on methods or types (classes and interfaces). We’ll use them only on methods throughout this article.


Theses annotations are not active by default – we’ll need to enable them with the @EnableGlobalMethodSecurity annotation and prePostEnabled = true – in our security configuration:

这些注解在默认情况下是不活跃的–我们需要在安全配置中用@EnableGlobalMethodSecurity注解和prePostEnabled = true来启用它们。

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig {
    // ...

3. Writing Security Rules


To write the security rules in these two annotations – we’ll make use of Spring-EL expressions; we can also use the built-in object filterObject to get a reference to the particular list element being tested.


Spring Security provides many other built-in objects to create very specific and exact rules.

Spring Security提供了许多其他内置对象,以创建非常具体和精确的规则。

For example, we can use @PreFilter to check if the assignee property of a Task object is equal to the name of the currently authenticated user:

例如,我们可以使用@PreFilter 来检查Task对象的assignee属性是否与当前认证用户的name相等。

@PostFilter("filterObject.assignee == authentication.name")
List<Task> findAll() {

We’ve used the @PostFilter annotation here since we want the method to execute and get all tasks first, and they pass every single task from the list through our filter rule.


So, if the authenticated user is michael, the final list of tasks returned by the findAll method would only contain the tasks that are assigned to michael, even if the database has tasks assigned to jim and pam.


Now let’s make the rule a little bit more interesting. Assume that if a user is a manager they can see all tasks, regardless of whom they are assigned to:


@PostFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
List<Task> findAll() {
    // ...

We’ve used the built-in method hasRole to check if the authenticated user has the role of MANAGER. If hasRole returns true, the task will be kept in the final list. So, if the user is a manager, the rule will return true for every item in the list. Thus the final list will contain all items.


Now let’s filter a list passed as a parameter to a save method using @PreFilter:


@PreFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
Iterable<Task> save(Iterable<Task> entities) {
    // ...

The security rule is the same as the one we’ve used on the @PostFilter example. The main difference here is that the list items will be filtered before the method executes, thus allowing us to remove some items from the list, preventing them from being saved in the database.


So jim, who is not a manager, may try to save a list of tasks, some of which are assigned to pam. However only those tasks assigned to jim will be included, the other ones will be ignored.


4. Performance on Large Lists


@PreFilter is really cool and easy to use, but it can be inefficient when dealing with very large lists since the fetching operation will retrieve all the data and apply the filter afterward.


Imagine, for example, that we have thousands of tasks in our database and we want to retrieve the five tasks that are currently assigned to pam. If we use @PreFilter, the database operation will fetch all the tasks first, and iterate through all of them to filter out the ones that are not assigned to pam.


5. Conclusion


This quick article explained how to create a simple, but secure, application using Spring Security’s @PreFilter and @PostFilter annotations.

这篇快速文章介绍了如何使用Spring Security的@PreFilter@PostFilter注解创建一个简单但安全的应用程序。

Check the complete code example in this Github repository.