Spring MVC中的Http Session

Question

I'm creating a very simple quiz application using spring mvc. It is working fine. But right now if a user is on the third question and another request comes in from another browser (another user) it will render the fourth question to the new user. I don't want this to happen. Every new request should start the quiz from the first question. How do I achieve this without having a login form for each user and yet identify each new request from a different browser as a different user? I know this can be achieved using sessions.

Can someone explain how to do this?

package dmv2.spring.controller;

import java.util.List;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.SessionAttributes;
import org.springframework.web.servlet.ModelAndView;

import dmv2.form.QuestionForm;
import dmv2.model.Exam;
import dmv2.model.Question;

@Controller
@SessionAttributes
@RequestMapping("/Exam")
public class ExamController
{
private List<Question> questions = (new Exam()).getQuestions();
private int            index     = 0;
private int            score     = 0;

@RequestMapping(method = RequestMethod.GET)
public ModelAndView showQuestionForm()
{
    Question q = questions.get(index);
    return new ModelAndView("exam", "questionForm", new QuestionForm()).addObject("q", q);
}

@RequestMapping(method = RequestMethod.POST)
public ModelAndView showQuestionForm2(@ModelAttribute("questionForm") QuestionForm questionForm, BindingResult result)
{
    Question q = questions.get(index);
    if(q.getAnswer().getRightChoiceIndex() == Integer.parseInt(questionForm.getChoice()))
        score = score + 1;
    index = index + 1;
    if(index < questions.size())
    {
        q = questions.get(index);
    }
    else
        return new ModelAndView("result").addObject("score", score);
    return new ModelAndView("exam", "questionForm", new QuestionForm()).addObject("q", q);
}

}

Answer 1

Never put state in a Controller, like in a Servlet, it will be global to everyone, and access to it has to be synchronised. In general is a good rule to just not put anything mutable as Controller's field. You shouldn't even put business logic in a Controller, you should call Objects from the service layer doing all the work with powerful services.

To come to your problem, you can define an interface called QuestSession that will act as proxy to the user conversational state. It's better if you implement boundary checks. (I guess index and score can't be negative, for example).

public interface QuestSession {
     public int getIndex();
     public void setIndex(int index);
     public int getScore();      
     public void setScore(int score);
}

Next you simply pass this interface where you need it, such as:

public ModelAndView showQuestionForm2(
    @ModelAttribute("questionForm") QuestionForm questionForm, 
    BindingResult result, QuestSession session) {

To make it work, you've to create a QuestSessionImpl and add in your XML configuration.

<bean id="questSessionImpl" class="package.QuestSessionImpl" scope="session">
    <aop:scoped-proxy />
</bean>

The aop:scoped-proxy , is the aspect oriented programming bit that does the magic of proxying your class so each session will talk to a different object. You can even use @Autowired on a Controller field and each session will still receive a different Object.

I don't know how to express it with annotations, if anyone is reading this knows it, please advice.

A word of warning. Even session access is not thread safe. Of course it's less dangerous than a global shared access to a single field, but it's still possible that a user opens two browser tabs or windows creating race conditions. You start to feel all the pain of it with AJAX, since many asynchronous request can come together. Even if you're not using AJAX, you may want to add proper synchronisation.