在Web应用中实现用户身份校验时，一种常见的做法是通过Session机制完成认证流程。本文介绍一种利用ThreadLocal实现请求级用户上下文传递的轻量级方案。

核心机制

该方案包含三个关键环节：登录态持久化、请求拦截校验、线程级上下文隔离。ThreadLocal在此起到关键作用——它确保每个HTTP请求线程拥有独立的用户存储空间，避免多线程环境下的数据干扰。

上下文容器设计

首先构建用户上下文持有类，采用泛型设计增强灵活性：

import com.example.auth.dto.UserProfile;

public class AuthContext {
    private static final ThreadLocal<UserProfile> contextHolder = new ThreadLocal<>();
    
    public static void bind(UserProfile profile) {
        contextHolder.set(profile);
    }
    
    public static UserProfile current() {
        return contextHolder.get();
    }
    
    public static void clear() {
        contextHolder.remove();
    }
}

登录业务实现

登录接口负责生成验证码、校验身份、建立会话。此处展示手机号验证码登录模式：

import cn.hutool.core.util.RandomUtil;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import org.springframework.stereotype.Service;
import javax.servlet.http.HttpSession;

@Service
public class AuthService extends ServiceImpl<UserMapper, User> {
    
    public Response sendVerifyCode(String mobile, HttpSession session) {
        if (!Validator.isMobile(mobile)) {
            return Response.error("手机号格式有误");
        }
        String verifyCode = RandomUtil.randomNumbers(6);
        session.setAttribute("verifyCode", verifyCode);
        // 实际场景中此处调用短信网关
        return Response.ok();
    }
    
    public Response authenticate(LoginRequest request, HttpSession session) {
        String mobile = request.getMobile();
        if (!Validator.isMobile(mobile)) {
            return Response.error("手机号格式有误");
        }
        
        String cachedCode = (String) session.getAttribute("verifyCode");
        if (cachedCode == null || !cachedCode.equals(request.getCode())) {
            return Response.error("验证码无效");
        }
        
        User account = lambdaQuery().eq(User::getMobile, mobile).one();
        if (account == null) {
            account = registerNewAccount(mobile);
        }
        
        session.setAttribute("account", account);
        return Response.ok();
    }
    
    private User registerNewAccount(String mobile) {
        User newbie = new User();
        newbie.setMobile(mobile);
        newbie.setUsername("user_" + RandomUtil.randomString(8));
        save(newbie);
        return newbie;
    }
}

拦截器实现认证逻辑

创建拦截器拦截非白名单请求，从Session提取用户信息并绑定至当前线程：

import org.springframework.web.servlet.HandlerInterceptor;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class AuthenticationFilter implements HandlerInterceptor {
    
    @Override
    public boolean preHandle(HttpServletRequest req, HttpServletResponse resp, Object handler) {
        HttpSession session = req.getSession(false);
        if (session == null) {
            resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        }
        
        UserProfile profile = (UserProfile) session.getAttribute("account");
        if (profile == null) {
            resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        }
        
        AuthContext.bind(profile);
        return true;
    }
    
    @Override
    public void afterCompletion(HttpServletRequest req, HttpServletResponse resp, 
                                Object handler, Exception ex) {
        AuthContext.clear();
    }
}

拦截器注册配置

最后将拦截器纳入SpringMVC处理链，配置放行规则：

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfiguration implements WebMvcConfigurer {
    
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new AuthenticationFilter())
                .addPathPatterns("/**")
                .excludePathPatterns(
                    "/auth/code",
                    "/auth/login",
                    "/public/**",
                    "/static/**"
                );
    }
}

使用方式

认证通过后，业务代码任意位置可通过AuthContext.current()获取当前登录用户信息，无需重复解析Session。请求结束时拦截器自动清理ThreadLocal，防止内存泄漏。