การส่งข้อความเฉพาะเจาะจงถึงผู้ใช้

So far messages went to a /topic that every subscriber receives. Real apps also need private messages: a chat whisper, a personal notification, an order update for one customer.

Spring supports the /user destination prefix. When a client subscribes to /user/queue/notifications, Spring rewrites it to a unique, per-session queue so only that user gets the message.

Targeted messaging needs to know who a session is. The Principal attached during the handshake (from Spring Security or a custom handshake handler) provides the username key.

In a controller method you annotate with @SendToUser. The return value is delivered only to the user who sent the triggering message.

The client subscribes to the /user-prefixed destination. Spring resolves it to that client's private queue automatically.

Outside a controller (e.g. from a service or scheduled job) use SimpMessagingTemplate.convertAndSendToUser to reach a specific user by name.

The UserDestinationMessageHandler maps /user/{username}/queue/x to the actual session-specific destination. You address users by name; Spring finds their active sessions.

One user may be connected from a phone and a laptop. convertAndSendToUser delivers to all of that user's active sessions, so notifications appear everywhere they are logged in.

To reach just one device, pass headers selecting a specific simpSessionId rather than broadcasting to every session of the user.

With a single server the simple broker resolves user destinations in-memory. Across multiple nodes you need an external broker (RabbitMQ) plus a UserRegistry broadcast so a node can route to a user connected elsewhere.

Never let a client choose another user's destination. Always derive the target from the authenticated Principal, not from client-supplied data, to prevent message hijacking.

You delivered private messages:

• The /user prefix maps to per-session queues
• @SendToUser replies to the originating user
• convertAndSendToUser pushes to a named user from anywhere
• Multiple sessions per user are reached together; target one with session headers
• Always derive the target from the authenticated Principal