最近在做一個官網登陸認證項目，因為登陸以后無需太多的角色校驗，所以改成角色簡單實現就好，沒有用太多框架組件，只用原聲寫。

直接上代碼：
首先我用的是前后端分離的，所以要解決跨域問題

@Configuration
public class CorsConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowedMethods("GET", "POST", "DELETE", "PUT","PATCH")
                .allowedHeaders("*")
                //cookie設置
                .allowCredentials(true).maxAge(3600);
    }

其次是使用springmvc的攔截器攔截登陸，所以要配置攔截器

@Configuration
public class WebAppConfig extends WebMvcConfigurerAdapter {
    // 多個攔截器組成一個攔截器鏈
    // addPathPatterns 用于添加攔截規則
    // excludePathPatterns 用戶排除攔截

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new LoginInterceptor())//添加攔截器
                .excludePathPatterns("/loginOK")//對應的不攔截的請求

                .addPathPatterns("/**"); //攔截所有請求
    }
}

要對用戶登陸放行，拿到token直接可以登錄，否則攔截，跳轉登陸

@GetMapping("/loginOK")
    @ResponseBody
    public String loginOK(HttpServletRequest httpServletRequest){
        HttpSession session = httpServletRequest.getSession();
        session.setAttribute("sessions","mytoken");
        System.out.println(session.getId());
        return "mytoken";
    }

接下來就是重點攔截器的寫法

/**
 * @Auther: sgy
 * @Date: 2019/12/9 22:08
 * @Description: TODO  模擬官網簡單登陸，攔截器session效驗token
 * @version: V1.0
 */
public class LoginInterceptor implements HandlerInterceptor {
    private static final Logger log = LoggerFactory.getLogger(LoginInterceptor.class);
    /**
     * 進入controller層之前攔截請求
     *
     * @param httpServletRequest
     * @param
     * @param o
     * @return
     * @throws Exception
     */
    @Override
    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse response, Object o) throws Exception {
        String header = httpServletRequest.getHeader("Authorization");
        String method = httpServletRequest.getMethod();
        //處理預請求
        if (HttpMethod.OPTIONS.toString().equals(method)) {
            return true;
        }
        else {
            HttpSession session = httpServletRequest.getSession();
            String id = session.getId();
            System.out.println(id);
            String sessions = (String) session.getAttribute("sessions");
            if (sessions.equals(header)) {
                return true;
            }
        }
        log.info("---------------開始進入地址攔截器-------------------"+header);
        return false;
    }
    //訪問controller之后 訪問視圖之前被調用
    @Override
    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
        log.info("--------------處理請求完成后視圖渲染之前的處理操作---------------");
    }
    //訪問視圖之后被調用
    @Override
    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
        log.info("---------------視圖渲染之后的操作-------------------------0");
    }
}

不知道預請求是啥的請看這篇文章
https://www.cnblogs.com/ermaoblog/p/8855915.html

親測有效，前段代碼就不展示了，自己用postman測試就可以
如果能幫到你，請點個贊吧