I'm currently transforming my Web Application tn Java with Spring MVC framework from ASP.NET (good way to learn it though -:) ) I need to implement authentication in my application: Please tell me if my approach is good and professional enough and if not what is the best practice to do that:
First of all I'm writing User class which holds all information about current user firstname/lastname/email/id/etc....
class User implements Serializable{
private String firstName;
private String lastName;
private Long id;
private String email;
///Settters and Getters
}
I'm implementing class Named DlSession and implementing it on sesison level.
<bean id="MySession" class="DlSession" scope="session">
<aop:scoped-proxy/>
class DlSession implements Serializable{
private User currentUser;
public DlSession(){}
// getters and setters:
}
When User submits his user/pass I'm verifying the credential and if user exists retrieving all the user Data to the instance of User class. Then I'm setting currentUser in Session to b the user I retrieved:
mySesison.setCurrentUser(user);
In order to verify authentication I need to check:
if (mySession.getcurrentUser() == null)
//return unauthenticated
else
//return authenticated
To logout user from system I just doing:
mySession.setcurrentUser(null);
Is this approach correct? any suggestions are more then welcomed. :)
