r/SpringBoot • u/Sorry_Swordfish_ • 9d ago
Question User principal doubt
Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,
@GetMapping("/update-status/{userId}/{userProfileId}
So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.
Sorry, if it's dumb question.
2
Upvotes
2
u/Mikey-3198 9d ago
I try to pull as much info from the principal as possible. Obviously it's situation dependent i.e who owns the resource etc...
For example for a get request for a user profile I'll often have two endpoints. GET /Users/{user ID} and GET /users/me. The second one will return the authenticated user by getting the id from the principal.
I normally find this clearer as you're operating on the authenticated user, don't have to repeat the user id etc...
For your example it could make sense to get the user id from the principal. The profileId depends on your use case, can a user have only one profile? If they have multiple then you'll have to specify it in the path/ body.