Question

Once a user is authenticated I have an Object userID.

Where is the “best” place to store this in Spring using Spring-Security (this is a webapp)?

• Session seems inelegant, because then I have two locations managing authentication (I need special code to manage removing the sesion object when the user is logged out for whatever reason)
• The currentContext.getAutentication().getDetails(…) seems complicated because it is seems to generate the details object per request

There are many options, but the best seems to be somewhere close to the Spring-Security authentication mechanism.

Answer 1

I am not sure about the question. You don’t have to store it. The are multiple ways to get it.

1. SecurtiryContextHolder if you need the UserDetails object
2. request.getRemoteUser() if you need only the loginId