In this video, let's try to implement filter and post filter annotations to achieve better level security
inside our application for the same.
If we can remember, we have a contact us page insider application where anyone can go ahead without
logging in and submit their contact request details to the bank staff.
So this is the controller where we have written previously.
As you can see, there is a method of contact and query details which will eventually save the details
to the database and will return a service request to the.
Here.
I just wanted to apply pre filtering conditions.
Again, this is nothing to do with the attribution because this is the open page.
I just want to show you these annotations like preauthorization pre filter, post or transpose filter,
all this kind of annotations.
You don't have to type with only attribution authentication, but you can tie it to any of the requirements
that you have.
So here you can see if someone sent me a request from the UAE or if there is no page at all inside my
application, if someone is invoking my API through the backend, nonviable applications in such scenarios,
I want to have a check using pre filter where if a user entered contact name as best, that means someone
is trying to do testing on my application, which I don't want to sell the details into my database.
So for the same, I have made this configuration changes like using pre filter, this filter object.
Is this the object that my code will refer?
And inside this contact object?
We have a contact name.
If someone sent a value which is equal to test, then this matter will not be invoked and eventually
an exception will be thrown to the UI application or any backend that is invoking this method.
So now we made the changes.
Let's try to restart our application.
I came to the UI here.
We can go to the contact us page and we don't need any login credentials for that.
I'm entering value as test in the name.
This is the value that we are testing in the backend and email.
I enter something test read e-mail, dot com subject will be hello.
Message will be.
This is a test message.
So now I'm clicking send message.
I should not get successful message from the backend.
As you can see on clicking send message.
Nothing is happening and you can check in the console.
I'm getting five hundred error because this is not an address.
That's the reason we are not getting four zero three.
Instead we're getting five hundred error.
If this is an API which is authorized users only can access, then in that scenario we should have got
four zero three ever.
So this way we can stop the execution of a method based upon the parameters that we are using by leveraging
pre filter annotation.
Now let's try to implement post filter annotation.
Also, I just replaced this pre with the post because I have a requirement where I should accept anything
that coming from the front end or someone is calling my API and I should save all those details inside
my database.
But if someone sent a contact name with the test, I should not send any service request.
No details to them because I know they are just testing.
I don't want to do a service request no.
To them.
So in such scenarios we can use force filter, which means our method business logic will be executed,
but user will not get the return details that my method is giving back to them.
So in order to do that, let's try to restart this application.
And I'm keeping a breakpoint here.
And I can assure you that the contact details will be eventually sent to the database and to an exception
coming from the post filter annotation.
The records that sale into the database will not be rolled back, as we discussed previously.
So you can see here now we have to contact details.
Now, I'll go to the you will be going to the contact us page and bring the same details test.
And trying to start the right email subject is hello, everybody.
Is this is a simple text message.
I'm clicking send and the breakpoint will stop here.
That means the framework is not stopping the method invocation.
It will let the details sale into the database, but you will not get any response.
The reason five hundred, which was triggered by the backend due to the configuration configurations
that we may let's try to go and see in the back end whether our message.
Disabled are not executing the query, as you can see here, my mother is so into the database, even
though there isn't 500 exhibition game that the card has not been rolled back because spring framework
will treat these exceptions as a security related exceptions only.
That's why it will never roll back the transactions that happen inside that matter.
So due to this reason, please be very careful.
While using post filter and pre filter will always give an assurance that your business logic will never
get executed if the authorization rules or any other rules that you configure are not met.
I hope this makes sense to you and how we can apply filtering attribution on top of your methods inside
any layer of your web application or non web application compared to our traditional way of implementing
to where parts are.
NVC parts with this will close this section by discussing summary of what we discussed in this section
in the next review.
Thank you.
And by.