Skip to content

Latest commit

 

History

History
83 lines (50 loc) · 2 KB

File metadata and controls

83 lines (50 loc) · 2 KB

🎯 Authentication Strategy

  1. Landing Page Transformation Header Update: Add Login/Signup buttons in top-right corner

Remove direct exam access: "Get Started" should lead to signup/login

Public access: Only the landing page (/) remains public

  1. Global Authentication Approach We have several options:

Option A: Interceptor/Filter (Recommended) Create a @Component interceptor that checks all routes except / and /auth/*

Automatically redirects unauthenticated users to login

Clean, centralized, no repetitive code

Option B: Method-level annotations Create custom @RequireAuth annotation

Apply to controller methods

More granular but requires annotation on every method

Option C: Continue manual checks Keep adding session checks to each controller method

Most repetitive but simple to understand

  1. Route Protection Strategy Public Routes:
  • / (landing page)
  • /auth/* (login, signup, logout)

Protected Routes (require authentication):

  • /dashboard
  • /exams
  • /exam/*

Copy

Insert at cursor 4. Header Navigation Logic Unauthenticated: Show Login/Signup buttons

Authenticated: Show user name + Dashboard link + Logout

  1. Implementation Plan Create authentication interceptor

Update landing page header with auth buttons

Remove manual session checks from controllers (interceptor handles it)

Update all templates to show appropriate navigation

Test authentication flow

🚀 Recommended Approach I suggest Option A (Interceptor) because:

DRY principle: No repetitive session checks

Centralized logic: Easy to modify auth rules

Automatic protection: New routes are protected by default

Clean controllers: Focus on business logic, not auth

Would you like me to implement this approach? The interceptor will:

Check if route needs authentication

Verify user session exists

Redirect to login if not authenticated

Allow request to proceed if authenticated

This way, we remove all the manual session.getAttribute("userId") checks from controllers and handle authentication globally.

What do you think of this approach?