Using @SessionAttributes and modelAttribute with validation in Spring Boot -

imagine application (written spring boot) login information (for example, username , password) , values want persist in session (for example, shopping cart)

first of all, have pojo information need in session

public class infovo implements serializable {    private string username;    private string password;    private string otherinformation1;    private string otherinformation2;    ... } 

on controller class have these annotations:

@controller @sessionattributes({"info"}) 

on init method have somethign this:

@requestmapping(value="/init", method = { requestmethod.post, requestmethod.get }) public string init(httpservletrequest request, httpservletresponse response, model model){    model.addattribute("info", new infovo());    return "login"; } 

and on method calling after login, obtain jsp fields, have this:

@requestmapping(value="/login", method = { requestmethod.post, requestmethod.get }) public string login(httpservletrequest request, httpservletresponse response, model model, @modelattribute("info") infovo infovo){      ...      model.addattribute("info", infovo); } 

i want validate fields inside form, implementing this:

public class loginvalidador implements validator {    public boolean supports(class<?> c) {return infovo.class.isassignablefrom(c);}    public void validate(object target, errors errors) {       ...    } } 

what's problem? don't know correct way write login.jsp. explain 2 examples.

version 1:

<form:form method="post" id="demo_form" action="login" class="form-horizontal" modelattribute="infovo">    ...    <form:input path="username" type="text"    ... </form:form> 

if write form this, need specify modelattribute, object want validate (infovo in case). if it, need obtain infovo fields on login controller , set these on session object "info". can't set directly on session object fields. need this:

model.addattribute("info", new infovo(username,password)); 

version 2:

in order use directly session object, can write jsp doing this:

<form method="post" id="demo_form" action="login">    username: <input id="username" name="username" type="text" value="${info.username}">    password: <input id="password" name="password" type="text" value="${info.password}"> </form> 

writing jsp, username , password values travel between jsp , controller , don't need set anything. controller have these values on infovo object.

but, doing this, how can validate form? in order validate form need specify commandname or modelattribute, , "info" not object validate. object infovo.

in resume... knows what's best practice doing this? version 1 correct? (a session object setted on controller form pojo) or version 2 more efficient (directly using session object)? , if version 2 best way, how can validate form validator implementation? need put on jsp in order use validator session object?

thanks in advance

p.d. don't wan't use spring security. login , password fiels example :)