if (userId != 0) {
// we have a logged in user, see if the session has the user on it
HttpSession session = request.getSession(false);
if (session != null) {
User user = (User) session.getAttribute(SESSION_ATTR_USER);
if (user == null) {
user = userService.findById(new DbId<User>(User.class, userId));
if (user == null)
throw new IllegalStateException("failed to lookup authenticated user");
else {
log.info("setting user id " + user.getId() + " into session " + session.getId());
session.setAttribute(SESSION_ATTR_USER, user);
}
}
else if (user.getId() != userId)
throw new IllegalStateException("id of stored user does not match current authenticated user");
}
}
return super.preHandle(request, response, handler);