How to create an @MVC form controller that doesn't require session

[cgarman1]

So I'm building a an @MVC form controller to perform email stuff. The shell of my controller is listed below and is pretty much a text book example of adding a model attribute on GET and accessing it on POST...and that works fine for things where a user is logged in a has a session...but as a user I would expect to be able to come to this email form, start typing my email, get up and walk away and have everything still be there when I come back 5 hours later. Currently when the session expires, I get the following exception thrown.

org.springframework.web.HttpSessionRequiredExcepti on: Session attribute 'email' required - not found in session

Do I have to use the @SessionAttributes("email") and if not, what will happen if I don't? It appears that as long as my domain object has an empty constructor it will instantiate and return a new object. Can someone verify what is suppose to happen without @SessionAttributes.

@Controller
@SessionAttributes("email")
public class EmailController {

@InitBinder
  public void initBinder(ServletRequestDataBinder binder) {
    binder.setAllowedFields(new String[] {"fromName","fromEmail","subject","message"});
    binder.registerCustomEditor(String.class, new StringTrimmerEditor(true));
  }
  
  
  @RequestMapping(value="/email.htm", method=RequestMethod.GET)
  public String loadForm(Model model) throws Exception {
    model.addAttribute("email", new Email());
    return context;
  }
  
  @RequestMapping(value="/email.htm", method=RequestMethod.POST)
  public String processForm(HttpServletRequest request, @ModelAttribute("email") final Email email, BindingResult result, SessionStatus status, Model model) {
    this.validator.validate(email, result);
    if(result.hasErrors()) {
      return context;
    } else {
      //send email
    }
  }
}

[Marten Deinum]

I suggest the reference guide which explains @SessionAttribute, basically if you want to reuse the object (because for instance it comes from the database) you need to store it somwhere, hence the sessionattribute. If you don't actually need that same object again and only use it to get some data entered there is no need to store it in the session.

If you don't have a default constructor you can also create a method annotated with @ModelAttribute which will be called before the request handling method is used, that way you can control how your object is created.

[cgarman1]

I suggest the reference guide which explains @SessionAttribute, basically if you want to reuse the object (because for instance it comes from the database) you need to store it somwhere, hence the sessionattribute. If you don't actually need that same object again and only use it to get some data entered there is no need to store it in the session.

If you don't have a default constructor you can also create a method annotated with @ModelAttribute which will be called before the request handling method is used, that way you can control how your object is created.

If I use the @SessionAttribute, what is the correct way to handle the exception that is generated when someone refreshes a page (the form) that uses the session variable. Since this form will be on an unauthenticated page, users won't know there is a session open.

If there is a way to catch the exception in my post method, I can just redirect them to the get method and have it load a new form. Any ideas?