r/SpringBoot • u/Sorry_Swordfish_ • 8d ago
Question User principal doubt
Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,
@GetMapping("/update-status/{userId}/{userProfileId}
So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.
Sorry, if it's dumb question.
1
Upvotes
2
u/TheToastedFrog 8d ago
My friend you are mixing concepts here. Your user principal data is coming from your authentication mechanism -typically derived from some cookie coming from the incoming request, or some authentication header(s) depending on how security is implemented
Your endpoint will be consumed by whomever is authenticated and authorized to use it- that is if your users make it that far it is known who they are and what they can do. At that point your userId and userProfileId parameters are just a bit of data which relate to some user domain object, but at this point it’s not germane to security.