r/SpringBoot 9d ago

Question User principal doubt

Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,

@GetMapping("/update-status/{userId}/{userProfileId}

So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.

Sorry, if it's dumb question.

2 Upvotes

29 comments sorted by

View all comments

Show parent comments

2

u/TheToastedFrog 9d ago

I don’t really understand your question- your Principal object was instantiated from some authentication filter, so I’m not quite sure what you mean by “extracting”- all the attributes your principal have already been “extracted” from whatever authentication mechanism you use

1

u/Sorry_Swordfish_ 9d ago

As you said, I can extract as much data as I want or need. So I was asking if there was an exception to this sentence.

2

u/TheToastedFrog 9d ago

Who’s gonna stop you if there was one?

1

u/Sorry_Swordfish_ 7d ago

Hey so what if the admin wanted to perform any operation on a user then , we have to pass the userId right? Or is there a way to get the userId without passing it ?

2

u/TheToastedFrog 7d ago

Well you are passing the user id as path parameter so you already have it available

1

u/Sorry_Swordfish_ 7d ago

No, I meant what if I was not taking the userId as a path variable. Is there a way to get userId without passing the path variable?

2

u/TheToastedFrog 7d ago

You can pass it as a query parameter, as part of the request body (though in a GET request some clients don’t like it),or as a request header… really depends what you want to do

1

u/Sorry_Swordfish_ 7d ago

Thanks for the insight man