Question

I have difficult understand the proper usage of @SessionAttribute annotation.

I wonder does the @SessionAttribute is used to store user authentication object or use to store the form object that exist within the session only.

I want to check whether a use has been login before invoke the handler.

I really confuse between these three class object.
Session scope bean
@SessionAttribute
HttpSession

Please give a proper example of @SessionAttribute usage and pron/cons of each of this

Thanks.

Answer 1

@SessionAttribute is for temporarily storing model objects in the session. Examples include storing a set of search criteria or storing data for a multi-page wizard.

If you’re after checking for authentication status, while in theory you could probably hack something together with @SessionAttribute, you’re much better off using Spring Security. There are many other authentication and authorization concerns that you aren’t addressing if you don’t have a security solution in place.