1

I have a java User object which i want to pass from my Login controller to my Dashboard controller. ive read a bunch and im trying the following implementation

public static Result authenticate(){
    Form<LoginForm> loginform = Form.form(LoginForm.class).bindFromRequest();
    if(loginform.hasErrors()){
        return badRequest(login.render(loginform));
    }
    else{
        session().clear();
        AppUser user = AppUser.getUserByEmail(loginform.get().email);
        Context.current().args.put("user", user);
        return redirect(routes.DashBoard.index());
    }

and my Dashboard controller

public static Result index(){
    AppUser user = (AppUser) Context.current().args.get("user");
    return ok(views.html.dashboard.index.render(user));
}

this results in nullpointerexception

this is because the two requests are not the same request of course.

how to solve this issue the a play friendly way By the way ive seen in the documentation something about action composition but i did not understand it.

Improve this question

3 Answers 3

Reset to default
3

Though I agree with Mauno's answer, I wanted to add that it is possible to use the cache API in play to do what you are asking.

One thing to keep in mind is that the cache is the same across multiple users. If you want to be able to access a particular user object from the cache, you're going to have to have a unique id for it. You're also going to store that id between requests. A play session is an easy way to do this.

here's an example

public static Result authenticate(){
    Form<LoginForm> loginform = Form.form(LoginForm.class).bindFromRequest();
    if(loginform.hasErrors()){
        return badRequest(login.render(loginform));
    }
    else{
        session().clear();
        AppUser user = AppUser.getUserByEmail(loginform.get().email);


        String uuid= java.util.UUID.randomUUID().toString();
        Cache.set(uuid,user);
        //store uuid in session for extracting the proper user from cache later
        session("uuid",uuid); 

        return redirect(routes.DashBoard.index());
    }


public static Result index(){
    //gather uuid stored in session (cookies)
    String uuid = session("uuid") 
    AppUser user = Cache.get(uuid);

    return ok(views.html.dashboard.index.render(user));
}

Also these objects won't have a predictable lifespan so you're going to have to make sure you check for their existence and potentially recreate the objects.

edit: I am unsure of this last statement, in playframework 1 the objects in the cache would be removed if they weren't used for a while, however it appears from this post that if you don't specify a timeout in playframework 2, they may persist indefinitely by default. It really depends on the configuation/module being used with the play api.

I wouldn't recommend this solution for the situation you've described. The database is a reasonable place to store this information, you should just retrieve the user data on each request.

Just wanted to say a cache for objects is possible.

Improve this answer
Sign up to request clarification or add additional context in comments.

7 Comments

IMHO, cache API or DB storgae is best option in this situation, anyway he will need to save each object with some unique key (and will need to pass the key with session scope) otherwise all users will be identified as first person who created cache entry.
You're absolutely right, ill try to explain that a little more then just linking to the docs
@biesior is correct cache API is not good for security implementations and repetative DB access is what im trying to prevent. also storing username in the session is not recommended as fake request can be made. im thinking of using a class with a MAP<String ,Object> like the one in the original HTTPSession object this works nice, my one problem is removing entries from this map when session expires- need to implement session listner like in HttpSessionListener interface
^Just curious why to pick a framework like play when you are actually not using the very key aspects it provides ? :) I havent come accross any real discussions which states that the play secured login is implemented in a "bad" way? I have used to store username or similar key to session with other frameworks too, imo: I dont see it as a security risk when details is not such :) I feel like you are trying to optimize or solve a problem which already has a solution.
@naoru from the docs: "Of course, cookie values are signed with a secret key so the client can’t modify the cookie data (or it will be invalidated)." I don't believe your concern about fake requests is warranted. The session is a fine place to store an id for items in the cache. If you really have a performance concern about repeatedly accessing the db then perhaps the cache is the solution for you. However it would be simpler not to, and it will probably perform well either way. If you abstract the gathering of the user, you'll be able add caching in later after doing performance testing.
|
2

Note: as your question is in general about 'passing objects between actions' Mike's answer fits best your needs, conclusion is: use cache and/or well prepared SQL statement (means getiing as small data as possible at the moment without additional relations, etc)

I think that's best candidate for 'accept answer'.

On the other hand, as from discussion it's becoming clear that you are asking in context of auth, thera are my 2cc:

  • Mauno's answer describes typical auth approach. Yes it requires additional query, however if you will use for an example H2 database in embeded mode it should not be a big problem - it's fast. Additionally you can exactly optimize that a little with cache API.
  • Actually there is some security gap in this approach... Although session cookies are signed, so they theoretically can't be manipulated... that doesn't change the fact, they can be just hijacked and reused by other person. Simplest solution is saving session on the server-side - in DB or in cache, so you can compare more details like IP, fingerprint etc. What's most important you can also invalidate whole server-side session on logout or after some time of inactivity, so even if attacker will grab the session, he will not be able to reuse it anymore. Of course this approach creates additional DB queries anyway you need to choose yourself what is more important to you, security or performance :)
  • There is ready to use authorization/authentication stack: Play-Authenticate, warned by hijack possibility I've created a sample on top of it, to demonstrate how to add a session handling using cache and/or DB: https://github.com/biesior/play-authenticate/commits/2.0.4_sessions/samples/java/play-authenticate-usage - check my latest commits for comments and code diffs.
Improve this answer

1 Comment

i always had the notion that db calls should be reduced to a minimum. i think that what you propose is the best solution meaning for fast queries (usualy using primary key) make another DB call and for more expensive calls (in my case it would be invoice details) make the call once and use the cache mechanizm. its been a productive debait thanks
1

You should not do this (or even need to do this), that was actually something I was also thinking when I started using play - then I realized that I didnt use framework how it was meant to be used.

Action composition is actually something which is used to protect certain methods or controllers being accessed. (Although you can use it for other things too). - But it is needed when you are implementing login.

Instead of passing your User object around .. your user email (username) are placed into session and it cant be later retrieved inside your controller side and templates. (Any of the controllers or templates.)

public static Result authenticate() {
    Form<Login> loginForm = form(Login.class).bindFromRequest();
    if (loginForm.hasErrors()) {
        return badRequest(login.render(loginForm));
    } else {
        session().clear();
        session("email", loginForm.get().email);
        return redirect(
            routes.Application.index()
        );
    }
}

I highly recommend checking out full zentask tutorial, if you are just more eager to know about login, you can check zentask page 4 (working zentask example is also located inside your play/samples/java/zentasks so its really easy to pick up with).

Relevant parts includes setting up own login form, view, controller with authenticate method and Secured class to handle actual method & or controller action protecting. Dont forgot to persist your users to database - otherwise there are not much to check against ;)

Edit:

If you open up your zentask tutorial you can see an example when controller needs authentication and when username is taken from the session, see the annotation: @Security.Authenticated(Secured.class) and method of request().username() which returns username as a String.. see: Http.Request.html#username() documentation

@Security.Authenticated(Secured.class)
public class Projects extends Controller {
    /**
     * Display the dashboard.
     */
    public static Result index() {
        return ok(
            dashboard.render(
                Project.findInvolving(request().username()),
                Task.findTodoInvolving(request().username()),
                User.find.byId(request().username())
            )
        );
    }

...

Method itself for example User.find.byId(request().username()) loads complete User from database for the model to be rendered. :)

But read the tutorial I provided, its complete example. Cheers.

Improve this answer

2 Comments

when i call the authenticate method i make a call to the database and check the user credentials. what i want to avoid is to make another call to get the user based on his email. this is why i want to store the user object as a whole
The call itself later at java side is not that expensive, it will take just milliseconds. If you know that you will be needing more like username and id all the time, you can add them both to session. But when you want User object as a whole, load it from database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.