防止未登录用户连接造成资源浪费，但是ws连接是无法像http一样完全自主定义请求头的，给token认证带来了不便。

1.利用请求头在通信子协议Sec-WebSocket-Protocol里携带token

前端示例代码

const token = user.token;

websocket = new WebSocket(`ws://localhost:9001/chat/${user.username}`,[token]);

2.在WebSocket第一次握手时设置请求头

设置过滤器拦截WebSocket请求，并设置请求头的信息

@Slf4j
@Component
@WebFilter(filterName = "WebsocketFilter", urlPatterns = {"/chat/**"})
public class WebSocketFilter implements Filter {

    private final AntPathMatcher ant = new AntPathMatcher();

    private static final String PASS_RUI = "/chat/**";

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String uri = request.getRequestURI();
        if (!ant.match(PASS_RUI,uri)) {
            filterChain.doFilter(servletRequest, servletResponse);
            return;
        }
        log.info("WebSocketFilter");
        String token = ((HttpServletRequest) servletRequest).getHeader(TokenConstant.WEBSOCKET_PROTOCOL);
        log.info("WebSocketFilter token:{}", token);
        response.setHeader(TokenConstant.WEBSOCKET_PROTOCOL,token);
        filterChain.doFilter(servletRequest, servletResponse);
    }

    @Override
    public void destroy() {

    }

}

3.测试

成功连接并且可以正常通过鉴权