Play Framework 2 Java Optional authentication

Question

I have been playing around with authentication. I want to be able to have some extra functions on certain pages available for those who log in. The problem is that if I don't use the @Security.Authenticated(Secured.class) annotation for the controller class I cannot get the username from the session so I cannot check if the user is logged in or not.

How should I go about this? Should I make sure all pages are authenticated and then have some sort of a guest login that automatically gets used for those other sessions or is there a way to check if the user is logged in even on a class without the @Security.Authenticated(Secured.class) annotation.

It would be great if someone could point me in the right direction, if there is a tutorial available that does this or just some guidance.

Answer 1

You should do two things:

1. Prevent unauthenticated users from viewing the functionality in your template:

    @if(session().containsKey(Secured.SESSION_AUTH_KEY)) { /* Your comment form */ } 

2. Prevent unauthenticated users from accessing your action:

    @Security.Authenticated(Secured.class) public static Result submitComment() { ... } 

With:

public class Secured extends Security.Authenticator {

    public static final String SESSION_AUTH_KEY = "email";

    public String getUsername(Http.Context context) {
        return context.session().get(SESSION_AUTH_KEY);
    }

    public Result onUnauthorized(Http.Context context) {
        ...
    }
}