title: Spring MVC & Security - Identification of protected resource during authorization
body: <p>I'm building a Tomcat/Java MVC Servlet app using Spring MVC and Spring Security, and have come upon what looks to me like an architectural inconsistency between the functionality of the Controller and the Authorization step.</p>
  
  <p>In standard MVC a display Controller examines the request, builds the model representation of the business resource(s) involved, and specifies the view that is to render the output to the client.</p>
  
  <p>In my use case the "business resource" being served is a "photo album" consisting of a configuration file (containing album title, copyright, etc) cached metadata (dimensions, thumbnails, access requirements, etc) and the actual images.  Some Albums are private, requiring that the user be logged in and have a specific group membership.  This part is well encapsulated in an <code>Album</code> class and associated factory responsible for managing instances.  Prior to adding security the Controller used the factory to find the requested <code>Album</code> instance, and placed it into the Model for use by the View.</p>
  
  <p>Then I added Spring Security to the mix. Since Authorization happens in the servlet filter chain (before the Controller is invoked) and Authorization needs access to the <code>Album</code> object to make an access control decision,  I am forced to locate/instantiate the <code>Album</code> during the Authorization phase instead.  This doesn't feel quite right but I can't see any other way to accomplish my goals without duplicating functionality.</p>
  
  <p>Question: Is it a normal pattern in web applications for some of the model-building to get pushed back into the Authorization step, or have I missed something important?  BTW, in order not to lookup/instantiate the model object twice I plan to put it into the <code>HttpServletRequest</code> as an attribute for use by the Controller.</p>