17
  1. What are the advantages to get principal as a parameter Principal principal in spring controller and then pass it to service layer over getting principal in the service layer immediately though SecurityContextHolder.getContext().getAuthentication().getPrincipal() ?
  2. What is the best approach to get principal details in service layer without checking getAuthentication() and getPrincipal() objects for null everywhere (something like a custom wrapper)?
4
  • 1
    You might find the answers to this question useful. This answer could be useful too. Feb 13, 2013 at 14:13
  • Is it a good solution to have abstract class with static method where I can put SecurityContextHolder.getContext().getAuthentication().getPrincipal()? After that I can use it in the service layer.
    – Alex
    Feb 14, 2013 at 0:40
  • Read the second link I gave you again. There's nothing to stop you using that approach in your services and if you use an interface you can also swap it out for testing. Feb 14, 2013 at 1:59
  • Thank you for your solution. But by using interface and implementation I will need to inject this to almost each service or could be to the base service class. How about using static method (from my comment above)? What is better?
    – Alex
    Feb 14, 2013 at 2:08

1 Answer 1

14
    • Your service API will be more easy to use. You will see dependency on principal directly, so you wan't call some service method by mistake in environment where principal does not exist.
    • In general less dependencies on SpringSecurity code means less problems in a case of migration to new Spring Security version.
    • You will be able to reuse your service layer in environment where Spring Security does not exist.
  1. Prepare some wrapper class (for example AuthenticationService). Add getPrincipal() method to it. Implement your checks. Inject AuthenticationService everywhere insted of direct calls to SecurityContextHolder.
6
  • If I need to get some data for specific user I think getting a principal (username for example) in the service layer is more secure because there are less layers between this (restriction) and database. So it's the only dao left as opposed to getting principal in the controller (additional service layer between). But on the other hand, as you said, service layer can be more reusable. What do you think about that?
    – Alex
    Feb 13, 2013 at 0:32
  • 3
    A principal object is hold and kept by web layer. So for me it looks natural that a principal came from contoller to service layer. Another point is that static dependencies are bad for unit testing: misko.hevery.com/2008/12/15/…. I do not see any security problems because a pincipal instance is immutable (and normally password will be eraised from actual implementation at this moment). Sorry for delay. I was AFK long time. Feb 27, 2013 at 18:08
  • Is it safe to use your option 2 in the extended BaseService (in service layer)?
    – Alex
    Mar 7, 2013 at 12:40
  • What do you mean under "safe"? Mar 8, 2013 at 9:36
  • 2
    It is thread safe because the principal is immutable. However you can have one litlle throuble related to multithreading. Imagine that thread A checks that authentication is not null like that: SecurityContextHolder.getContext().getAuthentication() != null. Then thread B performs SecurityContextHolder.clearContext(). After this thread A may has NPE here: SecurityContextHolder.getContext().getAuthentication().getPrincipal(). To avoid this situation always get a reference Authentication authentication = SecurityContextHolder.getContext().getAuthentication(). Mar 12, 2013 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.