In the previous lecture we had discussed about metal level security, how to implement using invocation
authorization.
So now in this lecture, let's try to understand how to implement metal level security using filtering
authorization.
So think of a scenario where you don't want to stop the invocation of the method blindly.
Instead, you want to relay on the parameters that is being passed to the method are that are coming
after the execution of the method.
So based upon the parameters to and fro to the matter, you want to apply some authorization rules in
such scenarios.
We will go to filtering authorization again.
Filtering authorization has two approaches.
One is with the pre filter and the other one is with the post filter.
As you can see here, there is a lawn service class which has a method update law and details which
will accept the loan details from the user and it will be updating that database.
But here I apply the pre filter authorization condition where if the current authenticated user is the
same as whatever username present inside the loan, then only invoke this method.
That means I should be able to update my own loan details, but not other loan details.
So this is how you can apply pre filter by checking the parameters that the method receive to decide
whether the method should be invoked or not.
Similarly, paused to filter.
Also, we can leverage in the scenarios where I want to execute my method.
Whatever the user logged in, I don't care about his or her authorization details.
But after executing while sharing the results to the user, I want to apply some filtering conditions
are apply some authorization rules, then only the results will be shared by the user.
Otherwise the results should not be shared and the four zero three error should come in such scenarios.
I can use post filter.
You can see here there is a lawn service class which has a method get lawn details which will return
the lawn details of an user.
But we can leverage post filter to make sure the loan details has the user name, same as the current
logged in user, which means I should be able to get the loan details from me only, but not other details.
We can also use post filter in spring data repositories like if you are getting hundreds of records,
but I want to share the user only the record specific to him in such scenarios.
Also, I can use post filter to filter the unwanted data.
Of course we can add to that using where conditions are also, but that is also possible using post
filter.
So now we have a basic understanding of what is filtering alteration in metal level security.
Next, will you let us try to do some hands on inside our application to understand them?
Thank you.
And see you in the next lecture by.