Interface HandlerInterceptor

public interface HandlerInterceptor

Runs around every controller method, for cross-cutting work that is not security: timing, auditing, tenant selection, request-scoped cleanup.

Declare one as a bean -- a @Component class implementing this interface, or a @Bean method returning one -- and the build hands it to every generated router. Several run in @Order order, and the ones without an order last in bean-name order.

Where it runs

1. The security filter chain: authentication, CSRF, the URL rules. A request it refuses never reaches an interceptor.
2. Route selection. Only a request that matched a controller route is intercepted; a 404 is not.
3. preHandle(HttpServer.Request, HandlerMethod), in order.
4. Binding, validation and the controller method, with its method security.
5. Exception handlers, when 3 or 4 threw.
6. postHandle(HttpServer.Request, HandlerMethod, HttpServer.Response), in reverse order, only when the controller method returned normally.
7. afterCompletion(HttpServer.Request, HandlerMethod, HttpServer.Response, Throwable), in reverse order, for every interceptor whose preHandle(HttpServer.Request, HandlerMethod) let the request through -- whatever happened after it.

Because the chain sits inside the security layer, an interceptor cannot admit a request security refused, and the failures security owns -- AccessDeniedException, AuthenticationException and their subclasses, CSRF included -- pass every interceptor and exception handler untouched on their way back to it.

Method Summary

Modifier and Type	Method	Description
default void	afterCompletion(HttpServer.Request request, HandlerMethod handler, HttpServer.Response response, Throwable failure)	Called once the request is finished with, on success, on a refusal by a later interceptor, on a binding or validation failure and on a failure nothing handled.
default void	postHandle(HttpServer.Request request, HandlerMethod handler, HttpServer.Response response)	Called after the controller method returned normally; not after a refusal, and not after an exception, handled or not.
default HttpServer.Response	preHandle(HttpServer.Request request, HandlerMethod handler)	Called before binding.

Method Details

preHandle

default HttpServer.Response preHandle(HttpServer.Request request,
 HandlerMethod handler)
                               throws Exception

Called before binding. Return null to let the request through, or a response to answer with instead -- the controller method is then not called, and afterCompletion(HttpServer.Request, HandlerMethod, HttpServer.Response, Throwable) runs only for the interceptors before this one.

Parameters:

request - the request

handler - the route it matched

Returns:

null to proceed, or the response to answer with

Throws:

Exception - routed to the exception handlers like the controller's own

postHandle

default void postHandle(HttpServer.Request request,
 HandlerMethod handler,
 HttpServer.Response response)
                 throws Exception

Called after the controller method returned normally; not after a refusal, and not after an exception, handled or not.

Parameters:

request - the request

handler - the route it matched

response - the response about to be written

Throws:

Exception - fails the request

afterCompletion

default void afterCompletion(HttpServer.Request request,
 HandlerMethod handler,
 HttpServer.Response response,
 Throwable failure)

Called once the request is finished with, on success, on a refusal by a later interceptor, on a binding or validation failure and on a failure nothing handled. This is the place for cleanup. A throw from here is logged and does not change the response.

Parameters:

request - the request

handler - the route it matched

response - the response, or null when the request failed unhandled

failure - what failed and was not handled, or null