java - How to use Spring Security @Pre and @Post annotations with collections -

we using spring security's acl annotations allow access web services. @preauthorize , @postauthorize seems extremely useful , favours of use cases having. spel based rules on individual methods et al helping in fine grain security on application , services.

for eg:- check owner of returned object below

@preauthorize("hasrole('role_admin') , returnobject.owner == authentication.name") public somedto getsomedto(){ ... } 

this works fine when single object returned. equivalent if list returned? how loop through collection , check individual element properties in collection using spel?

in case of collection should use @prefilter , @postfilter annotations.

when using @postfilter annotation, spring security iterates through returned collection , removes elements supplied expression false. name filterobject refers current object in collection. can filter before method call, using @prefilter, though less common requirement.

see example below or find more details here.

@preauthorize("hasrole('role_admin')") @postfilter("filterobject.owner == authentication.name") public list<somedto> getall();