Examples of hirondelle.web4j.security.LoginTasks

eb4j.com/UserGuide.jsp#DataOwnershipConstraints'>data ownership constraints.

The User Id Is a Server Secret

The user login name and the user id must be treated very differently. While the user login name can of course be displayed to the user, the user id is a server-side secret, and should never be made visible to the user. It's nobody's business, including the user to whom it belongs. You can place the user id in session scope, and your server-side code can use it, but its value can never be part of the HTTP response in any way. Exposing it allows one user to access the data of another. Always treat the user id as a server-side secret. Failure to do so is a huge security risk.

Consolidating User Preferences Into One Object

If there are many user preferences, and not just one, then it might make sense to place a single object into session scope, which gathers together all such preferences into a single object. Note, however, that the default implementations of {@link hirondelle.web4j.request.LocaleSource} and {@link hirondelle.web4j.request.TimeZoneSource}are not consistent with such a style, since they expect their data to be stored under separate keys defined in {@link hirondelle.web4j.Controller}.