Where should I log in the user based on http session: service or controller?

Question

I know that best practice is to let everything about authentication/authorization to the service layer.
Controller should not be aware of that.

But how to let a service (from service layer so) to check for http session if I do not pass in the http request?

In this particular case, when login needs some http request context, should the controller be master of the authentication and then pass the retrieved user as parameter of the service like this (in Java)? :

public interface SomeService {
     void aService(User user, ...);
}

Other example would be the use the JWT mechanism.
Should the validation of the token be triggered by the controller or by the service, assuming in this later case that we pass the token in parameter of the service?

Answer 1

In ASP.NET MVC, there are attributes that you can apply to the Controller methods that divert calls to an Unauthorized controller if the user isn't authenticated. This makes sense to me, since you want to catch intrusion attempts very early in the process. If the user isn't authenticated, the controller method doesn't even execute.

Once the user has been authenticated, authorization can take place in several ways. You can have role-based authentication that lets users perform some actions but not others. Roles and role assignments are typically kept in database tables that are driven by the user account that is logged in; you can even impersonate a user for support purposes.