# Using OAuth User sessions instead of cookies in APIs

**URL:** <https://sef.discourse.group/t/using-oauth-user-sessions-instead-of-cookies-in-apis/227>\
**Category:** ScholarX\
**Created:** [January 23, 2021, 8:56pm UTC](https://sef.discourse.group/t/using-oauth-user-sessions-instead-of-cookies-in-apis/227 "2021-01-23T20:56:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![piumal1999](https://yyz2.discourse-cdn.com/free1/user_avatar/sef.discourse.group/piumal1999/32/274_2.png) [@piumal1999](https://sef.discourse.group/u/piumal1999)\
**Post date:** [January 23, 2021, 8:56pm UTC](https://sef.discourse.group/t/using-oauth-user-sessions-instead-of-cookies-in-apis/227/1 "2021-01-23T20:56:19Z")

</div>

Previously we were using cookies to find the logged user’s profile id for the Endpoints since we haven’t completed the authentication part.

But now we can get the currently logged users details from the OAuth user session details. So I’m replacing the cookie value annotations with AuthenticationPrincipal annotations.

( Btw, we need to find a way to integrate the two modules before doing this change. Otherwise the frontend will break. If anyone have some idea on this please let me know. [@EngTeam](https://sef.discourse.group/groups/engteam) )

---

<div class="post-metadata">

**Author:** ![piumal1999](https://yyz2.discourse-cdn.com/free1/user_avatar/sef.discourse.group/piumal1999/32/274_2.png) [@piumal1999](https://sef.discourse.group/u/piumal1999)\
**Post date:** [January 23, 2021, 9:01pm UTC](https://sef.discourse.group/t/using-oauth-user-sessions-instead-of-cookies-in-apis/227/2 "2021-01-23T21:01:38Z")

</div>

> [@piumal1999](#):
>
> So I’m replacing the cookie value annotations with AuthenticationPrincipal annotations

I sent a draft pull request for this. Still I’m searching for a way to do the unit tests with Mock user.

> <https://github.com/sef-global/scholarx-backend-v1/pull/103/files>
>
> \## Purpose
> 
> The purpose of this PR is to fix #106 
> 
> \## Goals
> 
> Updating the… Endpoints to use the oauth user details to get the profile Id
> 
> \## Approach
> 
> Replaced cookie values with AuthenticationPrincipal
> 
> \## Checklist
> \- \[x\] This PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
> \- \[x\] I have read and understood the development best practices guidelines ( http://bit.ly/sef-best-practices )
> \- \[x\] My code follows the style guidelines of this project
> \- \[x\] I have performed a self-review of my own code
> \- \[x\] I have commented my code, particularly in hard-to-understand areas
> \- \[\] I have made corresponding changes to the documentation
> 
> \## Related PRs
>  
> N/A
> 
> \## Test environment
>  
> Ubuntu 19.04
> 
> 
> \## Learning
> 
> N/A