CODEWITHSUNDEEP
javaspringspring-mvcsession
dzrkot
dzrkot

Reputation: 603

properly use session in spring mvc

I use Spring 4.1.1. And I must make service of user session. What's the best way of storing session related data of a user? I read so many way's , but I don't understand which way is proper?

it's example that I need

@Controller
@SessionAttributes("user")
public class PagesController {
@RequestMapping(value="/sign_in", method = RequestMethod.POST)
public String getSignIn(@RequestParam(value="user")String user ,
                        @RequestParam(value="pass")String password,
                        Model model) {
    UserDAO dao = new UserDao();
    if(dao.isUserValid(user,password) && !model.containsAttribute("user")){
        User user = new User();
        model.addAttribute("user",user);
        return USER_PAGE;
    }
    return LOGIN_PAGE;
}

}

Upvotes: 3

Views: 2262

Answers (2)

Mustofa Rizwan
Mustofa Rizwan

Reputation: 10466

First of all, Session Attribute is not a good option to store your user object. It is spring who decides when to clear a session attribute data. As per spring documentation, spring removes a session attribute when it understands that a 'conversation' is completed. You only use session attribute when you are in a controller scope and the data is temporarily needed to be stored in the session.

As far as user login object goes, the thing you need to do is to use http sesison. When you login/sign in to your application you actually post the login credential to your controller. Once validated, you put the user object (with your necessary info-as less as possible- in to an object and store in to your session). This object will remain as long as it doesn't expire or you clear it when the user trigger logout.

Moreover if you still want to use SessionAttribute to store your user Object. Then there can be further problem when you deploy your application to a clustered environment. Your session will have to be copied to each instance of your server unless you implement sticky session. Copying httpsession is the simplest of task whereas copying the same instance of a sessionAttribute is not.

    @RequestMapping(value = "login.html", method = RequestMethod.POST)
    public ModelAndView post(@ModelAttribute("login") LoginEntity login, HttpServletRequest req) {


... process the data ...
if passed put it into session:

HttpSession session = req.getSession(true);
UserObject userObject=new UserObject();
userObject.setName(login.getUserName());
...

session.setAttribute("user",userObject);

Upvotes: 2

Duncan
Duncan

Reputation: 717

It is OK that you put your user object in session, and then use it in your project everywhere. However, if you get a lot of users, that means you have many user object in the memory of your server. The memory might run out.

Another way to do it is to put some user information in cookies with some encryption and validation, but just remember not to put too much info in cookies because cookies will be sent every time a request or a response is made. If there to much information to send, it will slow the response time.

And just a reminder, you should call status.setComplete() to clean the attributes inside a session when they are not needed.

Does SessionStatus object.setComplete() clears all the session attributes or just work for the controller in which it is used?

and if you don't know how to use it, you can see the article below

http://vard-lokkur.blogspot.tw/2011/01/spring-mvc-session-attributes-handling.html

Upvotes: 2

Related Questions