I am working on a blog system, and use Hibernate as my ORM framework. The blog system has Post
and Comment
entities. Both of them has a nested author
field, associated with the User
entity by a foreign key, like:
class Post{
@ManyToOne
private User author;
}
class Commment{
@ManyToOne
private User author;
}
Since I am using the Spring Security, so the User
entity implement UserDetails
and has password
field(of course, not plain text)
class User{
private String username;
private String password;
}
Most of the time, when returning the dto representation of Post
and Comment
to the front end, i need to embed the username and some other user information(like the profile picture's url) in the response json. Since the User
entity might be rarely modified, i'd like to cache the User
entities in Hibernate two-level cache.
However, as you can see, it means that the system always keeps the users credential in memory, i wonder if it might cause some security issue. I think that i should only cache the fields like username
or profilePictureUrl
in memory, but by Hibernate, seems that i cannot achieve that.