last day (15 days later) » 

2:09 PM
Discussion Summary:
Ralph wrote: Rest implementations should be stateless, so there is no need for a statefull bean
REST is intended to been stateless: so if you need an http session in your controller, than it is likely that you do not have an REST API
Hola Soy Edu Feliz Navidad asked: So, how would you check who is the current user? Decoding the token?
In a pure, 100% schoolbook like REST API, the client should pass its token with every request an the server should decode it in every request (JsonWebToken).
But in a real API you can use different shortcuts. In my personal opinion: If you use the session only for user credentials, then I would not call it a state. I think the that state in meaning of REST is more stuff like you have two requests: the first request send some Data to the Server, and the second request send an action what to do with this data, for example "use them to create an user"
Hello
 
Ok, but assume you have to use sessions, how would you deal with it?
 
Is it a Spring application?
 
Yes
This is the reason you have spring-session
 
In general I would extract the relevant information form the http session as soon as posible
and then tread them like any other data provided by the request
But Security is different
 
I understand, but lets focus that you have an application with sessions. how would you deal with it?
I just did a test and it seems that using @Autowired on a controller you get the current session.
 
2:20 PM
I would use the session as method parameter of the controller handler method
 
` @Autowired private HttpSession httpSession;`
 
no
 
Maybe the @RestControllers are not unique.
 
wait 10 sec
@Controller
 
I'm using @RestController
Maybe they are different by somehow
 
2:24 PM
@POST
public ModelAndView create(MyCommand myCommand, HttpSession httpSession) {
String user = httpSession.getAttribute("user")
service.doSomething(myCommand.x, user);
}
Much better would been using SpringSecurity, for example:
then spring security provides the user, and you can test it without mocking the session
@POST
public ModelAndView create(MyCommand myCommand, @AuthenticationPrincipal User user) {
service.doSomething(myCommand.x, user);
}
For a customized user object, have a look at this answer of mine: stackoverflow.com/a/8769670/280244
 
I'm not using spring MVC, more SpringBoot + Spring Web. When I got the project I'm working on all endpoints where like the way you said: @PostMapping public ResponseEntity method(HttpSession session, .......). I thought that it was being repeated too many times ( almost at 100 endpoints). Wouldn't you think that using using @Autowired would avoid code repetition?
 
Sorry, I do not understand the last question.
now I got it
 
Don't you think that using @Autowired rather than using sessions as argument would avoid code repetition ?
 
I do not think so. Have a look at my last Example:
public ModelAndView create(MyCommand myCommand, @AuthenticationPrincipal User user)
is less code than
convertToSomethingUsefull(this.httpSession.getAttribute("x"))
So I would prefer to make the required session attribute a parameter of the controller method.
 
What if you don't use Spring MVC, only spring web and spring boot?
 
2:36 PM
What is the part of Spring MVC that you need?
I think this code works with Spring Web
 
So what you say is to send Session as argument?
Why would I need to use ModelAndView?
 
ModelAndView can be replaced by any thing else, for example your JSON Response object
solved?
 
2:58 PM
I think so. Thanks.
 

last day (15 days later) »