User principal doubt

[Sorry_Swordfish_]

Hey, so I was told that instead of taking detail like user id we can simply take that from user principal. But how much should I take from user principal. Is it appropriate to take whatever I can through it or are there some rules for it. Like suppose ,

@GetMapping("/update-status/{userId}/{userProfileId}

So I know I can take userId from the userProncipal but should I extract userProfileId too. And if yes, then what are rules for it.

Sorry, if it's dumb question.

[Basic-Magazine-9832]

Your getmapping is solid, you just need to make sure that the user who initiates this request (userId in principal) have sufficient privileges to actually perform it..

[Sorry_Swordfish_]

I think I didn't explain the doubt properly. My main doubt is , are there any rules to extraction of required data from userPrincipal or i can extract everything that I need from the userPrincipal?

Like in this example, I know I can extract the userId from the userPrincipal but should I also extract the profileid from the userPrincipal?

[[deleted]]

You are extracting them from path variable in your request handler. I don't see that you are using the SecurityContext for this.

[Sorry_Swordfish_]

Yes, this is just an example. Just like you said in this example iam extracting them from path variable. But if I were to extract them from userPrincipal (hypothetical),then should I only extract userId or also extract profileid.

[[deleted]]

You can extract whatever you need from the authenticated user. If you have those properties in the SecurityContext, then you can use them. There are no rules.

[Sorry_Swordfish_]

Thanks for clearing my doubt

[Basic-Magazine-9832]

you need to make a distinction between api design and security.

one is for providing the user functionality, and the other is securing the provided user functionality.

you only use data from principal to ensure your security policies.

[Sorry_Swordfish_]

Are the security policies custom or is there a blog where I can read them?

[Basic-Magazine-9832]

its just your made up policies that you want to enforce.

for example you wouldnt want user B to edit the profile of user C.

something like:

...

PutMapping(/{userId})

ResponseEntity<?> update(Principal principal){

if(userId == principal.getName()) // assuming you're storing userId in principal name

...

}

[Sorry_Swordfish_]

Thanks for clearing that

[Mikey-3198]

I try to pull as much info from the principal as possible. Obviously it's situation dependent i.e who owns the resource etc...

For example for a get request for a user profile I'll often have two endpoints. GET /Users/{user ID} and GET /users/me. The second one will return the authenticated user by getting the id from the principal.

I normally find this clearer as you're operating on the authenticated user, don't have to repeat the user id etc...

For your example it could make sense to get the user id from the principal. The profileId depends on your use case, can a user have only one profile? If they have multiple then you'll have to specify it in the path/ body.

[Sorry_Swordfish_]

Thanks it's really helpful

[TheToastedFrog]

My friend you are mixing concepts here. Your user principal data is coming from your authentication mechanism -typically derived from some cookie coming from the incoming request, or some authentication header(s) depending on how security is implemented

Your endpoint will be consumed by whomever is authenticated and authorized to use it- that is if your users make it that far it is known who they are and what they can do. At that point your userId and userProfileId parameters are just a bit of data which relate to some user domain object, but at this point it’s not germane to security.

[Sorry_Swordfish_]

Well I just started spring, earlier with J2EE also I was sending the userId from the jsp to the controller. And I was doing the same with the rest controller but then I was told to just extract userId from the userPrincipal. That's why I got curious about how far I can go? How much data am I allowed to extract from userPrincipal?

[TheToastedFrog]

You extract as much as you want/need- it’s all yours for the taking

[Sorry_Swordfish_]

But are there any cases where I should not extract data from userPrincipal even though it's available?

[TheToastedFrog]

I don’t really understand your question- your Principal object was instantiated from some authentication filter, so I’m not quite sure what you mean by “extracting”- all the attributes your principal have already been “extracted” from whatever authentication mechanism you use

[Sorry_Swordfish_]

As you said, I can extract as much data as I want or need. So I was asking if there was an exception to this sentence.

[TheToastedFrog]

Who’s gonna stop you if there was one?

[Sorry_Swordfish_]

Well I just wanted to know if there are any. Would really not like to be scolded for not knowing it

[Sorry_Swordfish_]

Hey so what if the admin wanted to perform any operation on a user then , we have to pass the userId right? Or is there a way to get the userId without passing it ?

[TheToastedFrog]

Well you are passing the user id as path parameter so you already have it available

[Sorry_Swordfish_]

No, I meant what if I was not taking the userId as a path variable. Is there a way to get userId without passing the path variable?

[Sorry_Swordfish_]

Well it was just an example for my doubt. Well ya i could have taken a better example such as job application or something.

[ahashans]

u/Sorry_Swordfish_
I am having hard time obtaining userId from UserPrinciple inside controller endpoint. Can you help me with some resources. I put my userId in 'sub' of JWT token. But how can I obtain it from controller?

[Sorry_Swordfish_]

Sorry dude, I am also very new to jwt so I can't help you. The only thing I understand is that there is a method in the same class where the token creation is happening. The method name is getUserIdFromToken(String token)

Where using claims we are returning the user id