Authentication and Session Play Framework

Question

I am trying to figure out Authentication with the playframework using scala language.

What does the code below mean, the section with Security.username -> java.util.UUID.randomUUID().toString()

def authenticate = Action { implicit request =>
  loginForm.bindFromRequest.fold(
    formWithErrors => BadRequest(html.login(formWithErrors)),
    user => Redirect(routes.Application.index).withSession(Security.username -> java.util.UUID.randomUUID().toString())
  )
}

I want to create a website that will allow for users to access there own settings securely with a session.

Answer 1

This means you are writing a key-value-pair into your session (which in fact is a signed cookie)("key" -> "value" evaluates to a tuple ("key","value")).

As key 'Security.username' is used. This checks if a configuration 'session.username' is present and otherwise defaults to 'username'. So if you do not configure anything, the key is 'username'.

java.util.UUID.randomUUID().toString() generates a unique identifier (the username-value). If you already have any form of username, use this instead.

In contrast to a servlet (or eg php) session, a session in play is not stored on the server but ia cookie. Therefore only key-value pairs of type string are valid and the size is capped at 4k of data. Perhaps you want to only store the username in the session and load the settings from some other datastore (like your filesystem or a db). When implementing this lookup, using the caching capabilities of play is highly recommended.