Spring Security – @PreFilter and @PostFilter

1. Overview

In this article we’ll learn how to use the @PreFilter and @PostFilter annotations to secure operations in a Spring application.

When used together with the authenticated principal information, @PreFilter and @PostFilter allows us to define fine-grained security rules using Spring Expression Language.

2. Introducing @PreFilter and @PostFilter

Simply put, the @PreFilter and @PostFilter annotations are used to filter lists of objects based on custom security rules we define.

@PreFilter defines a rule for filtering the return list of a method, by applying that rule to every element in the list. If the evaluated value is true, the element will be kept in the list, otherwise the element will be removed.

@PostFilter works in a very similar fashion, however the filtering is applied to a list that is being passed as an input parameter to the annotated method.

Both annotations can be used on methods or types (classes and interfaces). We’ll use them only on methods throughout this article.

Theses annotations are not active by default – we’ll need to enable them with the @EnableGlobalMethodSecurity annotation and prePostEnabled = true – in our security configuration:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    ...
}

3. Writing Security Rules

To write the security rules in these two annotations – we’ll make use of Spring-EL expressions; we can also use the built-in object filterObject to get a reference to the particular list element being tested.

Spring Security provides many other built-in objects in order to create very specific and exact rules.

For example, we can use @PreFilter to check if the assignee property of a Task object is equal to the name of the currently authenticated user:

@PostFilter("filterObject.assignee == authentication.name")
List<Task> findAll() {
    ...
}

We’ve used the @PostFilter annotation here since we want the method to execute and get all tasks first, and them pass every single task from the list through our filter rule.

So, if the authenticated user is michael, the final list of tasks returned by the findAll method would only contain the tasks that are assigned to michael, even if the database has tasks assigned to jim and pam.

Now let’s make the rule a little bit more interesting. Assume that if a user is a manager they can see all tasks, regardless of whom they are assigned to:

@PostFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
List<Task> findAll() {
    ...
}

We’ve used the built-in method hasRole to check if the authenticated user has the role of MANAGER. If hasRole returns true, the task will be kept in the final list. So, if the user is a manager, the rule will return true for every item in the list, thus the final list will contain all items.

Now let’s filter a list passed as a parameter to a save method using @PreFilter:

@PreFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
Iterable<Task> save(Iterable<Task> entities) {
    ...
}

The security rule is exactly the same as the one we’ve used on the @PostFilter example. The main difference here is that the list items will be filtered before the method executes, thus allowing us to remove some items from the list, preventing them from being saved in the database.

So jim, who is not a manager, may try to save a list of tasks, some of which are assigned to pam. However only those tasks assigned to jim will be included, the other ones will be ignored.

4. Performance on Large Lists

@PreFilter is really cool and easy to use, but it can be inefficient when dealing with very large lists since the fetching operation will retrieve all the data and apply the filter afterwards.

Imagine, for example, that we have thousands of tasks in our database and we want to retrieve the 5 tasks that are currently assigned to pam. If we use @PreFilter, the database operation will fetch all the tasks first, and iterate through all of the them to filter out the ones that are not assigned to pam.

5. Conclusion

This quick article explained how to create a simple, but secure, application using Spring Security’s @PreFilter and @PostFilter annotations.

Check the complete code example in this Github repository.