在Spring Security中成功登录后如何处理用户信息

Question

I want to use user-information after login succeed. I thought about storing it into session attribute. or using @scope('session) annotation. but I haven't found the best way of doing it. so I just stored it into model-attribute.

@Controller
@RequestMapping(value = "/user")
public class UserController {

    @Autowired
    private UserService userService;

    @Autowired
    private UserProfileService userProfileService;

    @ModelAttribute("user") 
    public User getUserModel () {

        return userService.findByEmail(SecurityContextHolder.getContext().getAuthentication().getName());
    }

    @ModelAttribute("userProfile")
    public UserProfile getUserProfile() {

        return userProfileService.findByUser(userService.findByEmail(SecurityContextHolder.getContext().getAuthentication().getName()));
    }

    @GetMapping("/")
    public String userIndex() { 

        logger.info("UserIndex");
        return "userPage";
    }

As you can see, SecurityContextHolder.getContext().getAuthentication().getName() --> this method repeated. every time user make HTTP request, is this good practice? or any better way of store user-infomation in application?

Answer 1

I would go with this.

@RequestMapping(value = "/username", method = RequestMethod.GET)
@ResponseBody
public String currentUserName(Authentication authentication) {
    return authentication.getName();
}