@RequestMapping("/login")
 public String login(HttpServletRequest request, HttpServletResponse response, Map<String, Object> map) throws Exception{ 
  String userName = request.getParameter("userName");
  String password = request.getParameter("password");
  HttpSession session = request.getSession();
  ServletContext application = session.getServletContext(); //獲取application
  
  User user = new User(userName, password);
  User currentUser = userService.login(user);
  if (currentUser == null) {
   request.setAttribute("error", "用戶名或密碼錯(cuò)誤");
   return "login";
  }
  
  String userId = String.valueOf(currentUser.getId()); //獲取userId
  map.put("currentUser", currentUser); //將user保存到session中，注意要使用@SessionAttributes注釋
  if(application.getAttribute("userId") == null){ //說明還沒有用戶登錄
   application.setAttribute(userId, session.getId()); //將sessionId保存到application
   application.setAttribute(session.getId(), session); //將session保存到application
  }else{ //說明已經(jīng)有用戶登錄
   String sessionId = (String) application.getAttribute(userId); //根據(jù)userId獲取上一個(gè)用戶的sessionId
   HttpSession oldSession = (HttpSession) application.getAttribute(sessionId); //根據(jù)sessionId獲取上一個(gè)用戶的session
   oldSession.invalidate(); //使oldSession失效
   application.removeAttribute(oldSession.getId()); //將oldSession從application中移除
   application.setAttribute(session.getId(), session); //將新的session保存到application
   application.removeAttribute(userId); //將oldSession的id從application中移除
   application.setAttribute(userId, session.getId()); //將新的session的Id保存到application
  }
  return "main";
 }