java登录验证（session机制）

登录接口：

验证用户名密码正确之后设置session，作为判断该用户是否登录的标识，这个标识在拦截器或过滤器中起作用，也可在用户登录后的一些操作中取到用户信息

@RequestMapping("login")
    @ResponseBody
    public ResultJson login(String username,String password) {
        Site site = frontUtils.loadSite();
        BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
        Member member = new Member();
        member.setUsername(username);
        Member person = memberService.getMember(member);
        if(person!=null&&passwordEncoder.matches(password,person.getPassword())){
            httpSession.setAttribute(FrontConfig.FONT_SESSION, person);
            //验证通过后台设置session
            return ResultJson.ok(person);

        }
        else{
            return ResultJson.failure(ResultCode.LOGIN_ERROR);
        }
    }

    @RequestMapping("logout")
    public String Logout(Model model) {
        //用户登出后将session置空
        httpSession.removeAttribute(FrontConfig.FONT_SESSION);
        return "redirect:/";
    }

public class FrontAuthFilter implements Filter {
    private Logger log =  LoggerFactory.getLogger(FrontAuthFilter.class);
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        HttpSession session  = request.getSession();
        Member member = (Member) session.getAttribute(FrontConfig.FONT_SESSION);
        if(member == null){
            //用户想要访问的路径
            String url = request.getRequestURI();
            //设置session值
            session.setAttribute(FrontConfig.FONT_FRIST_URL, url);
            //用户未登录-跳转到登录页面
            response.sendRedirect("/front/login");
        } else {
            //用户已经登录-允许访问其他资源
            chain.doFilter(request, response);
        }
    }
    @Override
    public void destroy() {
    }
}

js：

function getLogin() {
        var obj = {};
        obj.username = $('#identity').val();
        obj.password = $('#desStr').val();
        $.ajax({
            type: "POST",
            url: "front/login",
            data: obj,
            success: function (result) {
                if (result.code == 200) {
                    location.href = "peoples.whtml"
                }
                else{
                    message(result.msg);
                }
            }
        });
    }

前台用户的一切请求都要先经过过滤器，如果session存在证明用户已经登陆了，否则未登录，要登录用户密码。

其实整个流程很清晰简单

拦截器相关代码实现