It's too hard to log in

HttpSession session = request.getSession(false);

1. When the user requests to log in for the first time, the session that still exists on the server side must be invalidated first:

if(session != null)

    session.invalidate();

Then generate the session:

session = request.getSession();

You can set how long the session will be deleted without operating the session:

session.setMaxInactiveInterval(60 * 60);

response.setStatus(401);
response.setHeader("WWWAuthenticat", "qwerasdfzcxv");

2. Obtain the authentication information of user login from the header file, including user ID and authentication string.

3. Go to the database to obtain the user information according to the user ID, splicing the strings to generate the authentication ciphertext and compare the authentication string in the header file to confirm whether the login is successful.

4. Logout operation:

HttpSession session = request.getSession();
if (session == null)
    response.setStatus("500");
else
    session.invalidate();