Spring Security - @PreFilter and @PostFilter

Refactor Java code safely — and automatically — with OpenRewrite.

Refactoring big codebases by hand is slow, risky, and easy to put off. That’s where OpenRewrite comes in. The open-source framework for large-scale, automated code transformations helps teams modernize safely and consistently.

Each month, the creators and maintainers of OpenRewrite at Moderne run live, hands-on training sessions — one for newcomers and one for experienced users. You’ll see how recipes work, how to apply them across projects, and how to modernize code with confidence.

Join the next session, bring your questions, and learn how to automate the kind of work that usually eats your sprint time.

Distributed systems often come with complex challenges such as service-to-service communication, state management, asynchronous messaging, security, and more.

Dapr (Distributed Application Runtime) provides a set of APIs and building blocks to address these challenges, abstracting away infrastructure so we can focus on business logic.

In this tutorial, we'll focus on Dapr's pub/sub API for message brokering. Using its Spring Boot integration, we'll simplify the creation of a loosely coupled, portable, and easily testable pub/sub messaging system:

>> Flexible Pub/Sub Messaging With Spring Boot and Dapr

1. Overview

In this article, we’ll learn how to use the @PreFilter and @PostFilter annotations to secure operations in a Spring application.

When used together with the authenticated principal information, @PreFilter and @PostFilter allows us to define fine-grained security rules using Spring Expression Language.

2. Introducing @PreFilter and @PostFilter

Simply put, the @PreFilter and @PostFilter annotations are used to filter lists of objects based on custom security rules we define.

@PostFilter defines a rule for filtering the return list of a method, by applying that rule to every element in the list. If the evaluated value is true, the item will be kept in the list. Otherwise, the item will be removed.

@PreFilter works in a very similar fashion, however, the filtering is applied to a list that is being passed as an input parameter to the annotated method.

Both annotations can be used on methods or types (classes and interfaces). We’ll use them only on methods throughout this article.

Theses annotations are not active by default – we’ll need to enable them with the @EnableMethodSecurity annotation and prePostEnabled = true (this is enabled by default in this annotation)- in our security configuration:

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class WebSecurityConfig {
    // ...
}

3. Writing Security Rules

To write the security rules in these two annotations – we’ll make use of Spring-EL expressions; we can also use the built-in object filterObject to get a reference to the particular list element being tested.

Spring Security provides many other built-in objects to create very specific and exact rules.

For example, we can use @PreFilter to check if the assignee property of a Task object is equal to the name of the currently authenticated user:

@PostFilter("filterObject.assignee == authentication.name")
List<Task> findAll() {
    ...
}

We’ve used the @PostFilter annotation here since we want the method to execute and get all tasks first, and they pass every single task from the list through our filter rule.

So, if the authenticated user is michael, the final list of tasks returned by the findAll method would only contain the tasks that are assigned to michael, even if the database has tasks assigned to jim and pam.

Now let’s make the rule a little bit more interesting. Assume that if a user is a manager they can see all tasks, regardless of whom they are assigned to:

@PostFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
List<Task> findAll() {
    // ...
}

We’ve used the built-in method hasRole to check if the authenticated user has the role of MANAGER. If hasRole returns true, the task will be kept in the final list. So, if the user is a manager, the rule will return true for every item in the list. Thus the final list will contain all items.

Now let’s filter a list passed as a parameter to a save method using @PreFilter:

@PreFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
Iterable<Task> save(Iterable<Task> entities) {
    // ...
}

The security rule is the same as the one we’ve used on the @PostFilter example. The main difference here is that the list items will be filtered before the method executes, thus allowing us to remove some items from the list, preventing them from being saved in the database.

So jim, who is not a manager, may try to save a list of tasks, some of which are assigned to pam. However only those tasks assigned to jim will be included, the other ones will be ignored.

4. Performance on Large Lists

@PostFilter is really cool and easy to use, but it can be inefficient when dealing with very large lists since the fetching operation will retrieve all the data and apply the filter afterward.

Imagine, for example, that we have thousands of tasks in our database and we want to retrieve the five tasks that are currently assigned to pam. If we use @PostFilter, the database operation will fetch all the tasks first, and iterate through all of them to filter out the ones that are not assigned to pam.