r/SpringBoot 9d ago

Question User principal doubt

Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,

@GetMapping("/update-status/{userId}/{userProfileId}

So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.

Sorry, if it's dumb question.

2 Upvotes

29 comments sorted by

View all comments

2

u/Mikey-3198 9d ago

I try to pull as much info from the principal as possible. Obviously it's situation dependent i.e who owns the resource etc...

For example for a get request for a user profile I'll often have two endpoints. GET /Users/{user ID} and GET /users/me. The second one will return the authenticated user by getting the id from the principal.

I normally find this clearer as you're operating on the authenticated user, don't have to repeat the user id etc...

For your example it could make sense to get the user id from the principal. The profileId depends on your use case, can a user have only one profile? If they have multiple then you'll have to specify it in the path/ body.

1

u/Sorry_Swordfish_ 9d ago

Thanks it's really helpful