@RequestMapping(value = "/login", method = RequestMethod.POST)
public String login(String userName, String password, RedirectAttributes redirectAttributes, HttpServletRequest request) {
//判断用户是否已经在线及处理（已在线则剔除）
String loginLimite = limiteLogin.loginLimite(request, userName);
//判断用户名、密码是否正确
String result = userService.login(userName, password);
if (result.equals("success")) {
request.getSession().setAttribute("now_user", userService.findByUserName(userName));
//创建token及验证
String jwtToken = tokenService.createUserAuthToken(userService.findByUserName(userName));//生成token
System.out.println(jwtToken);
UserAuthenticationToken authToken = tokenService.retrieveUserAuthToken(jwtToken);//token解析
System.out.println(authToken.isAuthenticated());
System.out.println("id = " + UserAuthenticationToken.getCurrentToken().getUserUuid());
//用户掉线，登录后重定向到保存的链接
Object url = request.getSession().getAttribute("redirect_link");
if (url != null) {
request.getSession().removeAttribute("redirect_link");
return "redirect:" + url.toString();
}
return "index";
}
redirectAttributes.addFlashAttribute("message", result);
return "redirect:/other/toLogin";
}

@Service
@Transactional
public class LimiteLogin {
private static Logger log = Logger.getLogger(SessionListener.class);
private static Map<String, String> loginUserMap = new HashMap<>();//存储在线用户
private static Map<String, String> loginOutTime = new HashMap<>();//存储剔除用户时间
@Autowired
private UserService userService;
public String loginLimite(HttpServletRequest request, String userName) {
User user = userService.findByUserName(userName);
String sessionId = request.getSession().getId();
for (String key : loginUserMap.keySet()) {
//用户已在另一处登录
if (key.equals(user.getUserName()) && !loginUserMap.containsValue(sessionId)) {
log.info("用户：" + user.getUserName() + "，于" + DateUtil.dateFormat(new Date(), "yyyy-MM-dd HH:mm:ss") + "被剔除！");
loginOutTime.put(user.getUserName(), DateUtil.dateFormat(new Date(), "yyyy-MM-dd HH:mm:ss"));
loginUserMap.remove(user.getUserName());
break;
}
}
loginUserMap.put(user.getUserName(), sessionId);
request.getSession().getServletContext().setAttribute("loginUserMap", loginUserMap);
request.getSession().getServletContext().setAttribute("loginOutTime", loginOutTime);
return "success";
}
}

public class LoginInterceptor extends HandlerInterceptorAdapter {
@Override
public boolean preHandle(HttpServletRequest request,
HttpServletResponse response, Object handler) throws Exception {
HttpSession session = request.getSession();
User user = (User) session.getAttribute("now_user");
if (session.getAttribute("now_user") == null) {
response.sendRedirect(request.getContextPath() + "/other/toLogin");
return false;
}
//多用户登录限制判断,并给出提示信息
boolean isLogin = false;
if (user != null) {
Map<String, String> loginUserMap = (Map<String, String>) session.getServletContext().getAttribute("loginUserMap");
String sessionId = session.getId();
for (String key : loginUserMap.keySet()) {
//用户已在另一处登录
if (key.equals(user.getUserName()) && !loginUserMap.containsValue(sessionId)) {
isLogin = true;
break;
}
}
}
if (isLogin) {
Map<String, String> loginOutTime = (Map<String, String>) session.getServletContext().getAttribute("loginOutTime");
session.setAttribute("mess", "用户：" + user.getUserName() + "，于 " + loginOutTime.get(user.getUserName()) + " 已在别处登录!");
loginOutTime.remove(user.getUserName());
session.getServletContext().setAttribute("loginUserMap", loginOutTime);
response.sendRedirect(request.getContextPath() + "/other/toLogin");
return false;
}
return super.preHandle(request, response, handler);
}
@Override
public void postHandle(HttpServletRequest request,
HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
super.postHandle(request, response, handler, modelAndView);
}
@Override
public void afterCompletion(HttpServletRequest request,
HttpServletResponse response, Object handler, Exception ex)
throws Exception {
super.afterCompletion(request, response, handler, ex);
}
}

public classSessionListener implements HttpSessionListener {
private static Logger log = Logger.getLogger(SessionListener.class);
@Override
public void sessionCreated(HttpSessionEvent event) {
}
@Override
public void sessionDestroyed(HttpSessionEvent event) {
HttpSession session = event.getSession();
String sessionId = session.getId();
//在session销毁的时候,把loginUserMap中保存的键值对清除
User user = (User) session.getAttribute("now_user");
if (user != null) {
Map<String, String> loginUserMap = (Map<String, String>) event.getSession().getServletContext().getAttribute("loginUserMap");
if(loginUserMap.get(user.getUserName()).equals(sessionId)){
log.info("clean user from application : " + user.getUserName());
loginUserMap.remove(user.getUserName());
event.getSession().getServletContext().setAttribute("loginUserMap", loginUserMap);
}
}
}
}

<!-- session listener 多用户登录限制,退出清除session信息的同时清除application中存放用户登录信息-->
<listener>
<listener-class>com.service.limitelogin.SessionListener</listener-class>
</listener>

<script type="text/javascript">
$(document).ready(function () {
var message='${mess}';
if (message != "") {
$.ajax({
type: 'GET',
async: false,
cache: false,
url: '/other/clearUserSession',
dataType: '',
data: {},
success: function (data) {
}
});
$('#mess').html(message);
}
});
</script>

/**
* 多用户登录限制,清除session信息(登录信息、提示信息)
*
* @param request
* @return
*/
@ResponseBody
@RequestMapping(value = "/clearUserSession")
public String clearUserSession(HttpServletRequest request) {
HttpSession httpSession = request.getSession();
//httpSession.invalidate();
httpSession.removeAttribute("now_user");
httpSession.removeAttribute("mess");
return "success";
}