We have a number of endpoints where a check on authorisation is required so are looking at creating a RequestFilter for this purpose. To minimise database access; we’d like the authorisation check to access the database and determine authorisation and then add the authorising object to the request so it does not need to be re-retrieved in the service itself.
Is there a way to add properties to the request in the RequestFilter or should we be adding the property to the request DTO, perhaps marked as internal to hide it from the clients.
edit: grammar