The logic of login is very simple. You only need to make corresponding judgment according to the incoming user name and password and match the data in the database

Basic realization

1. In the controller layer, first make a non empty judgment on the incoming user name and password, and then call the Service layer for database matching. If the matching is successful, the user information will be saved in the session domain, and redirected to the admin/index request, and the index page will be returned
Mainly, because form submission is involved here, you must use redirection request to forward and return to index page directly when you jump to another page. Because browser address does not change, repeated submission will occur when refreshing
Request forwarding and redirection

@Controller
@RequestMapping("/admin")
public class AdminController {
    @Autowired
    private AdminService adminService;
    @GetMapping
    public String loginPage(){
        return "admin/login";
    }
@GetMapping({ "/index", "/index.html"})
    public String index(HttpServletRequest request) {
        return "admin/index";
    }

    @PostMapping(value = "/login")
    public String login(String userName,
                        String password,
                        HttpSession session) {
        System.out.println(userName);
        System.out.println(password);
        if (StringUtils.isEmpty(userName) || StringUtils.isEmpty(password)) {
            session.setAttribute("errorMsg", "User name or password cannot be empty");
            return "admin/login";
        }
        AdminUser adminUser = adminService.login(userName, password);
        if (adminUser != null) {
            session.setAttribute("loginUser", adminUser.getNickName());
            session.setAttribute("loginUserId", adminUser.getAdminUserId());
            //The session expiration time is set to four hours
            session.setMaxInactiveInterval(60 * 60 * 4);
            return "redirect:/admin/index";
        } else {
            System.out.println("Landing failed");
            session.setAttribute("errorMsg", "Landing failed");
            return "admin/login";
        }
    }

    @GetMapping("/logout")
    public String logout(HttpServletRequest request) {
        request.getSession().removeAttribute("loginUserId");
        request.getSession().removeAttribute("loginUser");
        request.getSession().removeAttribute("errorMsg");
        return "admin/login";
    }
}

2. service layer
Because the password stored in the database needs to be encrypted by MD5, the password passed in should be MD5 converted before database comparison

@Override
    public AdminUser login(String userName, String password) {
        String passwordMd5 = MD5Utils.code(password);
        return adminUserMapper.getUser(userName, passwordMd5);
    }

MD5Utils

public class MD5Utils {
    public static String code(String str){
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            md.update(str.getBytes());
            byte[]byteDigest = md.digest();
            int i;
            StringBuffer buf = new StringBuffer("");
            for (int offset = 0; offset < byteDigest.length; offset++) {
                i = byteDigest[offset];
                if (i < 0)
                    i += 256;
                if (i < 16)
                    buf.append("0");
                buf.append(Integer.toHexString(i));
            }
            //32 bit encryption
            return buf.toString();
            // 16 bit encryption
            //return buf.toString().substring(8, 24);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            return null;
        }

    }
}

3. dao level

AdminUser getUser(@Param("userName") String userName, @Param("password") String password);

<select id="getUser" resultType="com.javaer.myblog.entity.AdminUser">
        select * from admin_user where login_user_name = #{userName,jdbcType=VARCHAR} AND login_password=#{password,jdbcType=VARCHAR} 
</select>

Interceptor configuration

The reason why interceptors are configured is that all our backstage pages are requested by / Admin, and we want to be accessible only when we log in, but at present, we can access them only when we know that others know our corresponding request address, and we need to block all requests under / admin before we can release them after judging whether they are logged in or not
The judgment of whether to log in here is realized by judging that there is corresponding user information in the session domain. When we log in again, we store the user information in our session domain, and all users with corresponding information are the logged in users
Interceptor

@Component
public class AdminLoginInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object o) throws Exception {
        String uri = request.getRequestURI();
        if (uri.startsWith("/admin") && null == request.getSession().getAttribute("loginUser")) {
            System.out.println("wrong");
            request.getSession().setAttribute("errorMsg", "Please login again");
            response.sendRedirect("/admin");
            return false;
        } else {
            request.getSession().removeAttribute("errorMsg");
            return true;
        }
    }

}

Configuring Interceptors

package com.javaer.myblog.config;

import com.javaer.myblog.interceptor.AdminLoginInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class MyBlogWebMvcConfigurer implements WebMvcConfigurer {
    @Autowired
    private AdminLoginInterceptor adminLoginInterceptor;

    public void addInterceptors(InterceptorRegistry registry) {
        // Add an interceptor to intercept the url path prefixed with / admin
        registry.addInterceptor(adminLoginInterceptor)
                .addPathPatterns("/admin/**")
                .excludePathPatterns("/admin")//Release /admin
                .excludePathPatterns("/admin/login")//Release/admin/login
                .excludePathPatterns("/admin/dist/**")
                .excludePathPatterns("/admin/plugins/**");
    }

}