如何使用token保存用户登录信息

1.登录成功后生产token

登录成功之后，后台生成一个token，将token保存在redis中，key是token，value是用户id，并且把token响应给前端，前端每次请求时都把token传给后台进行鉴权。生成token代码如下：

    private String logining(String account,Long userId){
        String token = Constants.TOKEN + Md5Util.md5(account + String.valueOf(System.currentTimeMillis())) + new Random().nextInt(1000);
        RedisUtils.put(token, userId, DAYS, TOKEN_TIMEOUT);
        return token;
    }

2.自定义拦截器实现鉴权

@Order(Ordered.HIGHEST_PRECEDENCE)
public class AuthorizeInterceptor extends HandlerInterceptorAdapter {

    @Autowired
    private UserSysRedis userSysRedis;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {

        String accessToken = request.getHeader("access-token");
        String deviceId = request.getHeader("device-id");
        if (isNullOrEmpty(accessToken)) {
            throw new UnauthorizedException();
        }

        Long userId = RedisUtils.get(accessToken, Long.class);
        if (Objects.isNull(userId)) {
            throw new UnauthorizedException();
        }

        GlobalRequestContext.setUserId(userId);
        GlobalRequestContext.setAccessToken(accessToken);
        GlobalRequestContext.setDeviceId(deviceId);

        checkDeviceInfo(userId,deviceId);
        return super.preHandle(request, response, handler);
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
            throws Exception {
        super.afterCompletion(request, response, handler, ex);
    }

    /**
     * 校验设备信息
     * @param userId 用户id
     * @param deviceId 设备id
     */
    public void checkDeviceInfo(Long userId,String deviceId){
        if(StringUtils.isEmpty(deviceId)){
            return;
        }
        String key = AuthConstant.TEACHER_DEVICE_KEY+userId;

        //如果设备已注册到redis中，判断当前设备是否可用
        if(userSysRedis.hashHasKey(key,deviceId)){
            TeacherDeviceInfo deviceInfo = userSysRedis.hashGet(key, deviceId, new TypeReference<TeacherDeviceInfo>() {
            });
            if(Objects.isNull(deviceInfo)){
                return;
            }
            if(DeviceStatusEnum.ALTER_PASSWORD.equals(deviceInfo.getDeviceStatus())){
                //修改密码，抛出异常
                throw new CustomException(UserExceptionEnum.USER_ALTER_PASSWORD.getMsg(),
                        UserExceptionEnum.USER_ALTER_PASSWORD.getCode(),null);
            }
            return;
        }

        //如果未注册，则添加到redis中
        TeacherDeviceInfo teacherDeviceInfo = new TeacherDeviceInfo()
                .setDeviceId(deviceId)
                .setDeviceStatus(DeviceStatusEnum.NORMAL_STATUS);
        userSysRedis.hashPut(key,deviceId,teacherDeviceInfo);
    }
}

自定义拦截器继承HandlerInterceptorAdapter，在里面实现登录校验逻辑。逻辑是前端请求头传入token的值，后台拿到token后去redis中取，如果取到说明登录了，未取到说明没登录，跳转至登录页。

配置鉴权拦截器，交给spring管理：

/**
 * 教师端鉴权拦截器配置
 * @author liuzhihao
 * @date 2018/7/24
 */
@Configuration
@Slf4j
public class AuthorizeConfiguration extends WebMvcConfigurerAdapter {

    /**
     * 在此处将拦截器注册成一个bean，可以在拦截器中使用@Autowired注入其它对象
     */
    @Bean
    public AuthorizeInterceptor authorizeInterceptor(){
        return new AuthorizeInterceptor();
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authorizeInterceptor())
                .addPathPatterns("/**/teacher-app/**")
                .excludePathPatterns("/**/open/**");

        super.addInterceptors(registry);
    }
}

这样请求路径中只要有teacher-app都会被拦截到

3.使用

接口方法：

    @PutMapping("/teacher-app/{transferId}")
    public Response<SchoolClassTransfer> update(
            @PathVariable("transferId") Long transferId, @RequestParam Long classId,@RequestParam Integer status) {
        long userId = GlobalRequestContext.getUserId();
        //处理业务逻辑
        return new Response<SchoolClassTransfer>().ok(classTransfer);
    }

所有请求路径中带teacher-app的都会被拦截，进行鉴权，如果鉴权通过，则可以通过GlobalRequestContext.getUserId()取出登录用户id，鉴权不通过则抛出异常，前端跳转至登录页面。