I know that best practice is to let everything about authentication/authorization to the service layer.
Controller should not be aware of that.

But how to let a service (from service layer so) to check for http session if I do not pass in the http request?

In this particular case, when login needs some http request context, should the controller be master of the authentication and then pass the retrieved user as parameter of the service like this (in Java)? :

public interface SomeService {
     void aService(User user, ...);

Other example would be the use the JWT mechanism.
Should the validation of the token be triggered by the controller or by the service, assuming in this later case that we pass the token in parameter of the service?


In ASP.NET MVC, there are attributes that you can apply to the Controller methods that divert calls to an Unauthorized controller if the user isn't authenticated. This makes sense to me, since you want to catch intrusion attempts very early in the process. If the user isn't authenticated, the controller method doesn't even execute.

Once the user has been authenticated, authorization can take place in several ways. You can have role-based authentication that lets users perform some actions but not others. Roles and role assignments are typically kept in database tables that are driven by the user account that is logged in; you can even impersonate a user for support purposes.

  • So, if I follow you, in this kind of assistance (with annotations/attributes), you would only deal with user authorization in service layer, and let controller authenticates, passing the User entity to the service layer (or whatever other object). Is it right? – Mik378 Nov 15 '15 at 0:47
  • I'll add some more detail to my answer. – Robert Harvey Nov 15 '15 at 0:48
  • authentication is : user identity authorization: does this well authenticated user has access to this service. – Mik378 Nov 15 '15 at 0:50
  • I don't understand what you just said. – Robert Harvey Nov 15 '15 at 0:50
  • 1
    See my answer update. – Robert Harvey Nov 15 '15 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.