Http Session in Spring MVC

Question

I'm creating a very simple quiz application using spring mvc. It is working fine. But right now if a user is on the third question and another request comes in from another browser (another user) it will render the fourth question to the new user. I don't want this to happen. Every new request should start the quiz from the first question. How do I achieve this without having a login form for each user and yet identify each new request from a different browser as a different user? I know this can be achieved using sessions.

Can someone explain how to do this?

package dmv2.spring.controller;

import java.util.List;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.SessionAttributes;
import org.springframework.web.servlet.ModelAndView;

import dmv2.form.QuestionForm;
import dmv2.model.Exam;
import dmv2.model.Question;

@Controller
@SessionAttributes
@RequestMapping("/Exam")
public class ExamController
{
private List<Question> questions = (new Exam()).getQuestions();
private int            index     = 0;
private int            score     = 0;

@RequestMapping(method = RequestMethod.GET)
public ModelAndView showQuestionForm()
{
    Question q = questions.get(index);
    return new ModelAndView("exam", "questionForm", new QuestionForm()).addObject("q", q);
}

@RequestMapping(method = RequestMethod.POST)
public ModelAndView showQuestionForm2(@ModelAttribute("questionForm") QuestionForm questionForm, BindingResult result)
{
    Question q = questions.get(index);
    if(q.getAnswer().getRightChoiceIndex() == Integer.parseInt(questionForm.getChoice()))
        score = score + 1;
    index = index + 1;
    if(index < questions.size())
    {
        q = questions.get(index);
    }
    else
        return new ModelAndView("result").addObject("score", score);
    return new ModelAndView("exam", "questionForm", new QuestionForm()).addObject("q", q);
}

}

stivlo · Accepted Answer · 2011-10-31 04:55:20Z

7

Never put state in a Controller, like in a Servlet, it will be global to everyone, and access to it has to be synchronised. In general is a good rule to just not put anything mutable as Controller's field. You shouldn't even put business logic in a Controller, you should call Objects from the service layer doing all the work with powerful services.

To come to your problem, you can define an interface called QuestSession that will act as proxy to the user conversational state. It's better if you implement boundary checks. (I guess index and score can't be negative, for example).

public interface QuestSession {
     public int getIndex();
     public void setIndex(int index);
     public int getScore();      
     public void setScore(int score);
}

Next you simply pass this interface where you need it, such as:

public ModelAndView showQuestionForm2(
    @ModelAttribute("questionForm") QuestionForm questionForm, 
    BindingResult result, QuestSession session) {

To make it work, you've to create a QuestSessionImpl and add in your XML configuration.

<bean id="questSessionImpl" class="package.QuestSessionImpl" scope="session">
    <aop:scoped-proxy />
</bean>

The aop:scoped-proxy, is the aspect oriented programming bit that does the magic of proxying your class so each session will talk to a different object. You can even use @Autowired on a Controller field and each session will still receive a different Object.

I don't know how to express it with annotations, if anyone is reading this knows it, please advice.

A word of warning. Even session access is not thread safe. Of course it's less dangerous than a global shared access to a single field, but it's still possible that a user opens two browser tabs or windows creating race conditions. You start to feel all the pain of it with AJAX, since many asynchronous request can come together. Even if you're not using AJAX, you may want to add proper synchronisation.

edited Oct 31, 2011 at 4:55

answered Oct 31, 2011 at 4:15

stivlo

85.9k35 gold badges148 silver badges201 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

SerotoninChase Over a year ago

Great answer! Thanks for your answer. I autowired @Scope("session") and it created a different state for every different session and everything works fine. Do you still recommend me creating a class or an interface to store the state like you have done as opposed to wiring the whole controller in a session scope? Yes, I understand the importance of keeping the business logic away outside the controller. This is only a simple application aimed at understanding spring mvc.

Collectives™ on Stack Overflow

Http Session in Spring MVC

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related