I know that best practice is to let everything about authentication/authorization to the service layer.
Controller should not be aware of that.

But how to let a service (from service layer so) to check for http session if I do not pass in the http request?

In this particular case, when login needs some http request context, should the controller be master of the authentication and then pass the retrieved user as parameter of the service like this (in Java)? :

public interface SomeService {
     void aService(User user, ...);

Other example would be the use the JWT mechanism.
Should the validation of the token be triggered by the controller or by the service, assuming in this later case that we pass the token in parameter of the service?

1 Answer 1


In ASP.NET MVC, there are attributes that you can apply to the Controller methods that divert calls to an Unauthorized controller if the user isn't authenticated. This makes sense to me, since you want to catch intrusion attempts very early in the process. If the user isn't authenticated, the controller method doesn't even execute.

Once the user has been authenticated, authorization can take place in several ways. You can have role-based authentication that lets users perform some actions but not others. Roles and role assignments are typically kept in database tables that are driven by the user account that is logged in; you can even impersonate a user for support purposes.

  • So, if I follow you, in this kind of assistance (with annotations/attributes), you would only deal with user authorization in service layer, and let controller authenticates, passing the User entity to the service layer (or whatever other object). Is it right?
    – Mik378
    Nov 15, 2015 at 0:47
  • I'll add some more detail to my answer. Nov 15, 2015 at 0:48
  • authentication is : user identity authorization: does this well authenticated user has access to this service.
    – Mik378
    Nov 15, 2015 at 0:50
  • I don't understand what you just said. Nov 15, 2015 at 0:50
  • 1
    See my answer update. Nov 15, 2015 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.