views:

681

answers:

2

I'd like to be able to create a base controller in my Spring app that, among other things, determines if a user is a registered user or not. This base controller, following the template design pattern, would contain an abstract protected method that controller subclasses would implement.

The abstract method would have passed to it an instance of User, registered or otherwise. However, I have no idea how I would do this since it seems that by using controllers purely using the @Controller annotation each controller is free to define their request handling method however they like.

Would creating some sort of user service class that is injected into each controller and used to validate a user be one way to get around this? This begs the question (at least for me) how does such a controller get a hold of a HttpServletRequest or the Session object?

Thanks.

A: 

I think the Base Controller is not a good idea if the only code it is to have is for UserAuthentication...instead use Spring security. This is the best option.

Alternatively, you can have methods like this...take a look at the Spring reference..

@Controller("loginController")
public class LoginController {    

   @RequestMapping(value="/login.do", method=RequestMethod.POST)
   public String login(Model model, HttpServletRequest request) {

      String userIdFromRequest = (String)request.getParameter("userId");
      String password = (String)request.getParameter("password");

      boolean verified = ...send userIdFromRequest and password to the user service for 
      verification...

      if (verified){
        request.getSession().setAttribute("userId", userIdFromRequest);
      }

   }          

   //More Methods

}

Did it help?

-SB

SB
Thank you SB, I've considered that but just collecting some opinions on this right now. I am seriously considering Spring Security but also want to avoid code duplication everywhere -- I need to read up on Spring Security though.
richever
A: 
  1. Define an abstract BaseController, with no annotations
  2. Define concrete and abstract methods
  3. Call these methods from subclasses (which are annotated with @Controller) whenever needed.
Bozho
Thanks Bozho, that's sort of what I was thinking. I appreciate the response.
richever