Develop Reference

Spring boot injection failure

I want to inject into the new object a class that contains the user.
#GetMapping
public String listTopic(Principal principal, Model model){
Optional<Users> user = usersService.findByUsername(principal.getName());
if (user.isPresent()){
Topics topic = new Topics();
topic.setUsers(user.get());
model.addAttribute("newTopic", topic);
model.addAttribute("topics", topicsService.listTopics());
return "forum/forum";
}
return "/error";
}
#PostMapping
public String addTopic(#Valid #ModelAttribute("newTopic") Topics topic, BindingResult bindingResult){
if(bindingResult.hasErrors()){
return "forum/forum";
}
topicsService.addTopic(topic);
System.out.println(topic);
return "redirect:/forum";
}
When I pass sysout after setting user obect or adding attribute at getmapping section it shows me the exact object, but when I want to see it at the postmapping it throws nullpointerexception.

Your model is a request scope object. After each request it is lost. You need to pass this information to a session object that is alive through different requests in the same session
https://stackoverflow.com/a/18795626/7237884

How to pass extra parameter in Spring login

I am using Spring framework. At the login page you have to enter Username and password.
Now the user should also enter his role when logging in. So I put a combo box there where you can select role: Admin, User or Manager. So I extended the available function to be able to also process post. But somehow the combobox value is never received by this method. It seems spring filters it before.
#RequestMapping(value = { "/", "/login" }, method = {RequestMethod.GET,RequestMethod.POST})
public String loginPage(#RequestParam(required=false) String role) {
if (isCurrentAuthenticationAnonymous()) {
return "login";
} else {
return "redirect:/user/workingtimeNow" ;
}
}
As you can see I added RequestMethod.POST and #RequestParam(required=false) String role . But role is always null.

Spring security role-based authorisation best practices

So I basically have a controller method with a PreAuthorize annotation. By default the method will return all projects. The method signature also includes an optional query string (blank query means retrieve all records).
The issue is that if the logged in user is only supposed to view/manage his/her own records, the query string needs to include a filter in it such as "clientId:2".
Now to do that, I was thinking of using the Principal object to retrieve the logged in user and check if he/she is a client as well, then I update the query by adding the required filter to it.
I am just not sure if this is the best approach for this type of issues.
#PreAuthorize("hasAuthority('MANAGE_ALL') OR hasAuthority('VIEW_ALL') OR hasAuthority('MANAGE_OWN')")
#RequestMapping(value = "/projects", method = RequestMethod.GET)
public ResponseEntity<RestResponse> list(Principal principal, #RequestParam(value = "query", required = false, defaultValue = "") String query) {
//If a client is logged in, he/she will have the MANAGE_OWN authority so will need to update the query string to include clientId:<logged-in-client-id>

I would rather move the #PreAuthorize to an application service.
class SomeApplicationService {
UserService userService;
SecurityService securityService;
#PreAuthorize("hasAuthority('MANAGE_ALL') OR hasAuthority('VIEW_ALL') OR hasAuthority('MANAGE_OWN')")
public List<Project> getProjects(String clientId) {
User currentUser = userService.getLoggedInUser();
if(securityService.canManageAllProjects(currentUser))
//get all projects or projects of clientId
else if(securityService.canManageOwnProjects(currentUser))
//get own projects, ignore clientId
}
}

How to get Principal object in ModelAttribute method

I am trying to load some basic user information that should be available for every HTTP request. I read that I can do this with a #ControllerAdvice class with a #ModelAttribute method. For example:
#ControllerAdvice
public class DefaultController{
#ModelAttribute
public void load(ModelMap model){
}
}
However, I am having trouble accessing my Principal object managed by Spring Security. I have tried the following:
#ModelAttribute
public void load(ModelMap model, #AuthenticationPrincipal CustomUser user){
}
and
#ModelAttribute
public void load(ModelMap model, Principal user){
//Cast to CustomUser object
}
But both of these do not work. I am getting nulls for the user objects. I was wondering if anyone knew how to get the Principal object in #ModelAttribute methods

I just realized that when visiting my homepage for the first time, the user isn't authenticated so there wouldn't be a user object in spring security anyway.
I just needed to check if the object is null first like so
#ModelAttribute
public void load(ModelMap model, #AuthenticationPrincipal CustomUser user){
if(user != null){
long userId = user.getId();
//Query database with userId and add data to model
}
}

You can get an Authentication object using org.springframework.security.core.context.SecurityContextHolder
#ModelAttribute
public void addUserToModel(Model model) {
try {
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();
// do something
} catch (Exception ex) {
}
}
In fact, you can use SecurityContextHolder from anywhere in your application.

PUT request in Spring MVC

I'm trying to write a simple PUT request method in Spring MVC. I got the following:
#RequestMapping(value = "/users/{id}", method = RequestMethod.PUT)
public #ResponseBody User updateUser(#PathVariable("id") long id,
String name,
String email) {
User user = repository.findOne(id);
user.setName(name);
user.setEmail(email);
System.out.println(user.toString());
repository.save(user);
return user;
}
Which is obviously wrong, because it returns the following:
User{id=1, name='null', email='null'}
I also tried with #RequestBody annotation, but that also did not help. Any ideas what I'm doing wrong here would be greatly appreciated.

You can receive name and email whith the #RequestBody annotation:
#RequestMapping(value = "/users/{id}", method = RequestMethod.PUT)
public #ResponseBody User updateUser(#PathVariable("id") long id,
#RequestBody User user) {}
This is a better practice when it comes to REST applications, as your URL becomes more clean and rest-style.
You can even put a #Valid annotation on the User and validate its properties.
On your postman client, you send the User as a JSON, on the body of your request, not on the URL. Don't forget that your User class should have the same fields of your sent JSON object.
See here:

You did not tell spring how to bind the name and email parameters from the request. For example, by adding a #RequestParam:
public #ResponseBody User updateUser(#PathVariable("id") long id,
#RequestParam String name,
#RequestParam String email) { ... }
name and email parameters will be populated from the query strings in the request. For instance, if you fire a request to /users/1?name=Josh&email=jb#ex.com, you will get this response:
User{id=1, name='Josh', email='jb#ex.com'}
In order to gain more insight about defining handler methods, check out the spring documentation.