class LoginHandlerInterceptor implements HandlerInterceptor {

  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {

    // get token
    String token = request.getHeader("token");
    User user = null;
    if (StringUtils.isEmpty(token)){
      user = authenticator.getAuthUser(request);
      // if user is null
      if (user == null) {
        response.setStatus(HttpStatus.SC_UNAUTHORIZED);
        logger.info("user does not exist");
        return false;
      }
    }else {
       user = userMapper.queryUserByToken(token);
      if (user == null) {
        response.setStatus(HttpStatus.SC_UNAUTHORIZED);
        logger.info("user token has expired");
        return false;
      }
    }

    // check user state
    if (user.getState() == Flag.NO.ordinal()) {
      response.setStatus(HttpStatus.SC_UNAUTHORIZED);
      logger.info(Status.USER_DISABLED.getMsg());
      return false;
    }

    request.setAttribute(Constants.SESSION_USER, user);
    return true;
  }

}