Java Web防止同一用户同时登录几种常见的实现方式

// 假设userservice是一个服务类，用于处理用户登录逻辑
public class userservice {

    public user login(httpservletrequest request, string username, string password) {
        // 真实环境中，这里应该是从数据库验证用户名和密码
        user user = finduserbyusernameandpassword(username, password);

        if (user != null) {
            // 检查用户是否已经登录
            httpsession session = request.getsession(false);
            if (session != null) {
                // 如果session不为空，说明用户已登录，可以根据业务需求处理，这里简单示例为踢出前一个登录
                session.invalidate(); // 使之前的session失效
            }
            
            // 创建新的session，并保存用户信息
            httpsession newusersession = request.getsession(true);
            newusersession.setattribute("currentuser", user);
            return user;
        } else {
            return null; // 登录失败
        }
    }
}

@service
public class userservice {

    @autowired
    private userrepository userrepository;

    public user login(httpservletrequest request, string username, string password) {
        user user = userrepository.findbyusername(username);
        
        if (user != null && user.getpassword().equals(password)) {
            // 检查用户是否已登录
            if (user.getloginstatus()) {
                // 根据业务需求处理重复登录，这里假设直接覆盖之前的登录
                logout(request, user);
            }
            
            // 更新数据库中的登录状态和session id
            string sessionid = request.getsession().getid();
            user.setsessionid(sessionid);
            user.setloginstatus(true);
            userrepository.save(user);
            return user;
        }
        return null;
    }

    public void logout(httpservletrequest request, user user) {
        // 更新数据库中的登录状态
        user.setloginstatus(false);
        user.setsessionid(null);
        userrepository.save(user);
        
        // 清除session
        request.getsession().invalidate();
    }
}

<dependency>
    <groupid>io.jsonwebtoken</groupid>
    <artifactid>jjwt-api</artifactid>
    <version>0.11.2</version>
</dependency>
<dependency>
    <groupid>io.jsonwebtoken</groupid>
    <artifactid>jjwt-impl</artifactid>
    <version>0.11.2</version>
</dependency>
<dependency>
    <groupid>io.jsonwebtoken</groupid>
    <artifactid>jjwt-jackson</artifactid> <!-- 或jjwt-gson如果你使用gson -->
    <version>0.11.2</version>
</dependency>

import io.jsonwebtoken.claims;
import io.jsonwebtoken.jwts;
import io.jsonwebtoken.signaturealgorithm;
import java.util.date;
import java.util.hashmap;
import java.util.map;

public class jwtutils {
    private static final string secret_key = "secretkey"; // 应替换密钥
    private static final long expiration_time = 86400000; // 1天有效期

    // 生成token
    public static string generatetoken(string username) {
        date now = new date();
        date expiration = new date(now.gettime() + expiration_time);

        map<string, object> claims = new hashmap<>();
        claims.put("username", username);

        return jwts.builder()
                .setclaims(claims)
                .setissuedat(now)
                .setexpiration(expiration)
                .signwith(signaturealgorithm.hs256, secret_key)
                .compact();
    }

    // 验证token
    public static boolean validatetoken(string token) {
        try {
            jwts.parser().setsigningkey(secret_key).parseclaimsjws(token);
            return true;
        } catch (exception e) {
            return false;
        }
    }

    // 从token中获取用户名
    public static string getusernamefromtoken(string token) {
        claims claims = jwts.parser().setsigningkey(secret_key).parseclaimsjws(token).getbody();
        return claims.get("username", string.class);
    }
}

@restcontroller
@requestmapping("/api/auth")
public class authcontroller {

    @postmapping("/login")
    public responseentity<map<string, string>> login(@requestbody loginrequest loginrequest) {
        // 假设userservice能根据用户名和密码验证用户
        if (userservice.authenticate(loginrequest.getusername(), loginrequest.getpassword())) {
            // 生成token
            string token = jwtutils.generatetoken(loginrequest.getusername());

            // 假设tokenservice用于存储和管理token
            tokenservice.savetoken(token);

            map<string, string> response = new hashmap<>();
            response.put("token", token);
            return responseentity.ok(response);
        } else {
            throw new responsestatusexception(httpstatus.unauthorized, "invalid username or password");
        }
    }
}

// 示例拦截器或过滤器逻辑
public class jwtauthenticationfilter extends onceperrequestfilter {

    @autowired
    private tokenservice tokenservice;

    @override
    protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain)
            throws servletexception, ioexception {
        string token = gettokenfromrequest(request);
        if (jwtutils.validatetoken(token)) {
            string username = jwtutils.getusernamefromtoken(token);
            if (tokenservice.istokenactive(username, token)) {
                // token有效且未被其他会话使用，继续请求链
                filterchain.dofilter(request, response);
            } else {
                // 重复登录，可以在这里处理逻辑，如返回错误信息
                response.senderror(httpservletresponse.sc_unauthorized, "重复登录");
            }
        } else {
            // token无效，可以在这里处理逻辑
            response.senderror(httpservletresponse.sc_unauthorized, "无效的token");
        }
    }

    // 从请求中提取token的逻辑
    private string gettokenfromrequest(httpservletrequest request) {
        string bearertoken = request.getheader("authorization");
        if (stringutils.hastext(bearertoken) && bearertoken.startswith("bearer ")) {
            return bearertoken.substring(7);
        }
        return null;
    }
}