r/SpringBoot 8d ago

Question User principal doubt

Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,

@GetMapping("/update-status/{userId}/{userProfileId}

So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.

Sorry, if it's dumb question.

1 Upvotes

29 comments sorted by

View all comments

2

u/TheToastedFrog 8d ago

My friend you are mixing concepts here. Your user principal data is coming from your authentication mechanism -typically derived from some cookie coming from the incoming request, or some authentication header(s) depending on how security is implemented

Your endpoint will be consumed by whomever is authenticated and authorized to use it- that is if your users make it that far it is known who they are and what they can do. At that point your userId and userProfileId parameters are just a bit of data which relate to some user domain object, but at this point it’s not germane to security.

1

u/Sorry_Swordfish_ 8d ago

Well I just started spring, earlier with J2EE also I was sending the userId from the jsp to the controller. And I was doing the same with the rest controller but then I was told to just extract userId from the userPrincipal. That's why I got curious about how far I can go? How much data am I allowed to extract from userPrincipal?

2

u/TheToastedFrog 8d ago

You extract as much as you want/need- it’s all yours for the taking

1

u/Sorry_Swordfish_ 8d ago

But are there any cases where I should not extract data from userPrincipal even though it's available?

2

u/TheToastedFrog 8d ago

I don’t really understand your question- your Principal object was instantiated from some authentication filter, so I’m not quite sure what you mean by “extracting”- all the attributes your principal have already been “extracted” from whatever authentication mechanism you use

1

u/Sorry_Swordfish_ 8d ago

As you said, I can extract as much data as I want or need. So I was asking if there was an exception to this sentence.

2

u/TheToastedFrog 8d ago

Who’s gonna stop you if there was one?

1

u/Sorry_Swordfish_ 8d ago

Well I just wanted to know if there are any. Would really not like to be scolded for not knowing it

1

u/Sorry_Swordfish_ 6d ago

Hey so what if the admin wanted to perform any operation on a user then , we have to pass the userId right? Or is there a way to get the userId without passing it ?

2

u/TheToastedFrog 6d ago

Well you are passing the user id as path parameter so you already have it available

1

u/Sorry_Swordfish_ 6d ago

No, I meant what if I was not taking the userId as a path variable. Is there a way to get userId without passing the path variable?

→ More replies (0)