使用application作用域实现：当用户重复登录时，挤掉原来的用户

@RequestMapping("/login")
    public String login(HttpServletRequest request, HttpServletResponse response, Map<String, Object> map) throws Exception{    
        String userName = request.getParameter("userName");
        String password = request.getParameter("password");
        HttpSession session = request.getSession();
        ServletContext application = session.getServletContext();   //获取application
        
        User user = new User(userName, password);
        User currentUser = userService.login(user);
        if (currentUser == null) {
            request.setAttribute("error", "用户名或密码错误");
            return "login";
        }
        
        String userId = String.valueOf(currentUser.getId());   //获取userId
        map.put("currentUser", currentUser);   //将user保存到session中，注意要使用@SessionAttributes注释
        if(application.getAttribute("userId") == null){  //说明还没有用户登录
            application.setAttribute(userId, session.getId());    //将sessionId保存到application
            application.setAttribute(session.getId(), session);   //将session保存到application
        }else{   //说明已经有用户登录
            String sessionId = (String) application.getAttribute(userId);   //根据userId获取上一个用户的sessionId
            HttpSession oldSession = (HttpSession) application.getAttribute(sessionId);   //根据sessionId获取上一个用户的session
            oldSession.invalidate();   //使oldSession失效
            application.removeAttribute(oldSession.getId());   //将oldSession从application中移除
            application.setAttribute(session.getId(), session);   //将新的session保存到application
            application.removeAttribute(userId);   //将oldSession的id从application中移除
            application.setAttribute(userId, session.getId());   //将新的session的Id保存到application
        }
        return "main";
    }