diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/CompanyController.java b/src/main/java/com/dreamchaser/depository_manage/controller/CompanyController.java
index 01bfd460..14780612 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/CompanyController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/CompanyController.java
@@ -6,6 +6,7 @@ import com.dreamchaser.depository_manage.config.PortConfig;
 import com.dreamchaser.depository_manage.entity.*;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.CompanyService;
 import com.dreamchaser.depository_manage.service.DepositoryService;
 import com.dreamchaser.depository_manage.service.RoleService;
@@ -43,7 +44,11 @@ public class CompanyController {
      */
     @PostMapping("/allCompanyByParent")
     public RestResponse findCompanyByNoParent(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/govlist";
         Object page = map.get("page");
         Object pagesize = map.get("pagesize");
@@ -89,7 +94,11 @@ public class CompanyController {
      */
     @PostMapping("/companyByCondition")
     public RestResponse findcompanyByCondition(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/govlist";
         if (map.containsKey("state")) {
             Object state = map.get("state");
@@ -131,7 +140,11 @@ public class CompanyController {
      */
     @PostMapping("/allPostByOrganization")
     public RestResponse allPostByParent(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/positionlist";
         Object page = map.get("page");
         Object pagesize = map.get("pagesize");
@@ -184,7 +197,11 @@ public class CompanyController {
      */
     @PostMapping("/post_role")
     public RestResponse addUser(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Map<String, Object> userParam = new HashMap<>();
         userParam.put("position", ObjectFormatUtil.toInteger(map.get("userid")));
         List<UserByPort> userByPortList = LinkInterfaceUtil.FindUserByMap(userParam, userToken);
@@ -304,7 +321,11 @@ public class CompanyController {
      */
     @GetMapping("/findPostRole")
     public RestResponse findPostRole(@RequestParam Map<String,Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Map<String, Object> userParam = new HashMap<>();
         Integer postId = ObjectFormatUtil.toInteger(map.get("postId"));
         userParam.put("position", postId);
@@ -337,7 +358,11 @@ public class CompanyController {
     @GetMapping("/treeMenus")
     public RestResponse InitTreeMenus(HttpServletRequest request) {
         List<Object> list = new ArrayList<>();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         list = companyService.InitTreeMenus(userToken);
         return new RestResponse(list);
     }
@@ -352,7 +377,11 @@ public class CompanyController {
     @GetMapping("/departmentTreeMenus")
     public RestResponse departmentTreeMenus(HttpServletRequest request) {
         List<Object> list = new ArrayList<>();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         list = companyService.BuildQyWxAdministrationTreeMenus(userToken,crypt);
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryController.java b/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryController.java
index 20ad6d4c..e489fd7b 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryController.java
@@ -4,6 +4,7 @@ import cn.hutool.core.lang.Snowflake;
 import com.dreamchaser.depository_manage.entity.*;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.*;
 import com.dreamchaser.depository_manage.utils.*;
 import lombok.Data;
@@ -395,7 +396,11 @@ public class DepositoryController {
      */
     @GetMapping("/warehouseRecord")
     public RestResponse findDepositoryRecordByCondition(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         List<Depository> list = depositoryService.findDepositoryByCondition(map, userByPort);
         for (int i = 0; i < list.size(); i++) {
             Depository depository = list.get(i);
@@ -413,7 +418,11 @@ public class DepositoryController {
      */
     @GetMapping("/allWarehouseByParent")
     public RestResponse findDepositoryByNoParent(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         if ("".equals(map.get("parentId")) || map.get("parentId") == null) {
             map.put("parentId", 0);
         }
@@ -442,7 +451,11 @@ public class DepositoryController {
      */
     @PostMapping("/realDeleteDepository")
     public RestResponse realDeleteDepository(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (map.containsKey("id")) {
             Integer id = ObjectFormatUtil.toInteger(map.get("id"));
             new Thread(new Runnable() {
@@ -494,7 +507,11 @@ public class DepositoryController {
      */
     @PostMapping("/depository")
     public RestResponse insertDepository(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         return CrudUtil.postHandle(depositoryService.insertDepository(map, userToken), 1);
     }
 
@@ -506,7 +523,11 @@ public class DepositoryController {
      */
     @PostMapping("/depository_del")
     public RestResponse deleteDepository(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (map.containsKey("id")) {
             Integer id = ObjectFormatUtil.toInteger(map.get("id"));
 //            UpdateSonState(id.toString(),3,true); 修改为删除状态
@@ -559,7 +580,11 @@ public class DepositoryController {
      */
     @PostMapping("/EditDepositoryState")
     public RestResponse EditDepositoryState(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (map.containsKey("state")) {
             map.put("state", 1);
         } else {
@@ -656,7 +681,11 @@ public class DepositoryController {
     public Map<String, Object> echart_back_lastWeek(@RequestParam("type") String type, HttpServletRequest request) {
 
         // 获取当前登录用户
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
 
         List<String> show_weekday = new ArrayList<String>();
         show_weekday.add("周一");
@@ -730,7 +759,11 @@ public class DepositoryController {
     public Map<String, Object> echart_back_thisWeek(@RequestParam("type") String type, HttpServletRequest request) {
 
         // 获取当前登录用户
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
 
         // 设置展示天数
         List<String> show_weekday = new ArrayList<String>();
@@ -844,7 +877,11 @@ public class DepositoryController {
     @ResponseBody
     public Map<String, Object> learnLayuiAndEchart_back(@RequestParam("type") String type, HttpServletRequest request) {
         // 获取当前登录用户
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
 
         // 设置展示天数
         List<String> show_weekday = new ArrayList<String>();
@@ -1360,7 +1397,11 @@ public class DepositoryController {
      */
     @GetMapping("/find_depository")
     public RestResponse FindDepositoryByMid(@RequestParam("mid") String mid, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Material materialById = materialService.findMaterialById(Integer.parseInt(mid));
         Map<String, Object> param = new HashMap<>();
         param.put("depositoryId", materialById.getDepositoryId());
@@ -1507,7 +1548,11 @@ public class DepositoryController {
      */
     @GetMapping("/findDepositoryByParent")
     public RestResponse FindDepositoryByParentId(@RequestParam("parentId") String parentId, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Map<String, Object> param = new HashMap<>();
         param.put("parentId", parentId);
         List<Depository> depositoryRecordPByCondition = depositoryService.findDepositoryByCondition(param, userToken);
@@ -1522,7 +1567,11 @@ public class DepositoryController {
      */
     @GetMapping("/findManagerByDid")
     public RestResponse FindManagerByDid(@RequestParam("did") Integer did, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<Integer> userIdByDid = roleService.findUserIdByDid(did);
         List<UserByPortP> list = new ArrayList<>();
         for (Integer integer : userIdByDid) {
@@ -1537,7 +1586,11 @@ public class DepositoryController {
 
     @GetMapping("/findPostByCompany")
     public RestResponse findPostByCompany(@RequestParam("company") String company, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<AdministrationP> administrationPList = LinkInterfaceUtil.findCompanyBySuperior(company, userToken);
         int size = administrationPList.size();
         return new RestResponse(administrationPList, size, 200);
@@ -1548,7 +1601,11 @@ public class DepositoryController {
     public RestResponse InitTreeMenus(@RequestParam(value = "adminorg", required = false) Integer adminorg,HttpServletRequest request) {
         List<Object> list = new ArrayList<>();
         // 获取当前登录的用户
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (Integer.compare(0, adminorg) == 0) {
             list = depositoryService.InitTreeMenus("",userToken);
         } else {
@@ -1577,7 +1634,11 @@ public class DepositoryController {
     @GetMapping("/findDepositoryCountInfo")
     public RestResponse findDepositoryCountInfo(HttpServletRequest request){
         // 获取当前登录的用户
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户管理的仓库
         // 查询当前用户管理的仓库
         List<RoleAndDepository> depositoryAndRole = roleService.findDepositoryAndRole(userToken.getId());
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryRecordController.java b/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryRecordController.java
index 0b4e657e..64733ace 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryRecordController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/DepositoryRecordController.java
@@ -4,6 +4,7 @@ import com.alibaba.fastjson.JSONObject;
 import com.dreamchaser.depository_manage.entity.*;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.*;
 import com.dreamchaser.depository_manage.service.impl.QyWxOperationService;
 import com.dreamchaser.depository_manage.utils.*;
@@ -52,7 +53,11 @@ public class DepositoryRecordController {
 
     @GetMapping("/myApply")
     public RestResponse findDepositoryInAndOutRecordPByCondition(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("applicantId", userToken.getId());
         List<ApplicationInRecordP> applicationInRecordPlist = depositoryRecordService.findApplicationInRecordPByCondition(map, userToken);
         Integer InCount = depositoryRecordService.findApplicationInRecordPCountByCondition(map);
@@ -78,7 +83,11 @@ public class DepositoryRecordController {
 
     @GetMapping("/myTaskOut")
     public RestResponse myTaskOut(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("userId", userToken.getId());
         List<SimpleApplicationOutOrInRecordP> myTask = depositoryRecordService.findMyTaskOut(map, userToken);
 
@@ -89,7 +98,11 @@ public class DepositoryRecordController {
 
     @GetMapping("/myTaskIn")
     public RestResponse myTaskIn(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("userId", userToken.getId());
         List<SimpleApplicationOutOrInRecordP> myTask = depositoryRecordService.findMyTaskIn(map, userToken);
 
@@ -103,7 +116,11 @@ public class DepositoryRecordController {
         List<SimpleApplicationOutMinRecordP> result = new ArrayList<>();
         // isDone 为0为未完成，1为已完成
         String isDone = (String) (map.get("isDone"));
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户下所有未完成的扫码出库订单
         String key = "user:" + userToken.getId().toString();
         String minRecord = (String) redisTemplateForHash.opsForHash().get(key, "minRecord");
@@ -182,7 +199,11 @@ public class DepositoryRecordController {
 
     @PostMapping("/depositoryRecord")
     public RestResponse insertDepositoryRecord(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("applicantId", userToken.getId());
         Integer depositoryId = ObjectFormatUtil.toInteger(map.get("depositoryId"));
         Depository depository = depositoryService.findDepositoryById(depositoryId);
@@ -197,7 +218,11 @@ public class DepositoryRecordController {
     public RestResponse insertApplicationInRecord(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<Integer> params = (List<Integer>) map.get("params");
         Integer integer = 0;
         map.put("applicantId", userToken.getId());
@@ -411,7 +436,11 @@ public class DepositoryRecordController {
     // 出库申请
     @PostMapping("/applicationOut")
     public RestResponse insertApplicationOutRecord(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         map.put("applicantId", userToken.getId());
@@ -560,7 +589,11 @@ public class DepositoryRecordController {
     // 查看入库申请
     @GetMapping("/applicationInView")
     public RestResponse findApplicationInRecordByCondition(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<ApplicationInRecordP> list = new ArrayList<>();
         Integer recordPCount = 0;
         if (Integer.compare(userToken.getMaindeparment(), 361) == 0) {
@@ -588,7 +621,11 @@ public class DepositoryRecordController {
         Integer depositoryId = ObjectFormatUtil.toInteger(map.get("depositoryId"));
         // 0未完成1已完成
         Integer stateOnView = ObjectFormatUtil.toInteger(map.get("state"));
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前仓库信息
         Depository depositoryRecordById = depositoryService.findDepositoryById(depositoryId);
         // 获取当前用户要处理的记录信息
@@ -708,7 +745,11 @@ public class DepositoryRecordController {
     // 查看出库申请
     @GetMapping("/applicationOutView")
     public RestResponse findApplicationOutRecordByCondition(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取对应主订单
         List<ApplicationOutRecordP> list = new ArrayList<>();
         Integer countBy = 0;
@@ -773,7 +814,11 @@ public class DepositoryRecordController {
      */
     @PostMapping("/addApplicationToRedis")
     public RestResponse addApplicationToRedis(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<Integer> mids = (List<Integer>) map.get("mids");
         List<Integer> depositoryIds = (List<Integer>) map.get("depositoryIds");
         List<String> placeCodes = (List<String>) map.get("placeCodes");
@@ -802,7 +847,11 @@ public class DepositoryRecordController {
      */
     @PostMapping("/deleteApplicationToRedis")
     public RestResponse deleteApplicationToRedis(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<Integer> mids = (List<Integer>) map.get("iids");
         List<Integer> depositoryIds = (List<Integer>) map.get("depositoryIds");
         List<String> placeCodes = (List<String>) map.get("placeCodes");
@@ -821,7 +870,11 @@ public class DepositoryRecordController {
     //    出库审核
     @PutMapping("/review")
     public RestResponse review(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Integer review = depositoryRecordService.review(map, userToken.getId(), userToken, crypt);
@@ -834,7 +887,11 @@ public class DepositoryRecordController {
 
     @PutMapping("/reviewIn")
     public RestResponse reviewIn(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Integer review = depositoryRecordService.reviewIn(map, userToken.getId(), userToken, crypt);
@@ -848,7 +905,11 @@ public class DepositoryRecordController {
     //    库存转移
     @PutMapping("/transfer")
     public RestResponse transfer(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<UserByPort> departmentHeadByUsers = LinkInterfaceUtil.findDepartmentHeadByUser(userToken);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
@@ -967,7 +1028,11 @@ public class DepositoryRecordController {
     //    删除入库记录
     @PostMapping("/deleteApplicationInRecord")
     public RestResponse deleteApplicationInRecord(@RequestBody Map<String, Object> map,HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         if (map.containsKey("id")) {
@@ -984,7 +1049,11 @@ public class DepositoryRecordController {
     //    删除出库记录
     @PostMapping("/deleteApplicationOutRecord")
     public RestResponse deleteApplicationOutRecord(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         if (map.containsKey("id")) {
             Integer id = ObjectFormatUtil.toInteger(map.get("id"));
             return CrudUtil.deleteHandle(depositoryRecordService.deleteApplicationOutRecordById(id, userByPort), 1);
@@ -1034,7 +1103,11 @@ public class DepositoryRecordController {
         Integer pagesize = ObjectFormatUtil.toInteger(map.get("size"));
         int start = (page - 1) * pagesize;
         Integer end = page * 10;
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Long size = redisTemplateForHash.boundListOps("mids" + userToken.getId()).size();
         if (size == null) {
             size = 0L;
@@ -1086,7 +1159,11 @@ public class DepositoryRecordController {
      */
     @PostMapping("/createMultiApplication")
     public RestResponse createMultiApplication(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Integer quantity = ObjectFormatUtil.toInteger(map.get("quantity"));
@@ -1195,7 +1272,11 @@ public class DepositoryRecordController {
      */
     @PostMapping("/createMultiApplications")
     public RestResponse createMultiApplications(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         // 获取要处理的类型
@@ -1386,7 +1467,11 @@ public class DepositoryRecordController {
     // 确认将物料出库
     @PostMapping("/isCheckOut")
     public RestResponse isCheckOut(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Integer placeId = ObjectFormatUtil.toInteger(map.get("placeId"));
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/GroupController.java b/src/main/java/com/dreamchaser/depository_manage/controller/GroupController.java
index 9a6c4e41..cca6df6b 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/GroupController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/GroupController.java
@@ -8,6 +8,7 @@ import com.dreamchaser.depository_manage.pojo.GroupInfoP;
 import com.dreamchaser.depository_manage.pojo.RestResponse;
 import com.dreamchaser.depository_manage.pojo.RoleAndDepository;
 import com.dreamchaser.depository_manage.pojo.StatusInfo;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.DepositoryService;
 import com.dreamchaser.depository_manage.service.GroupService;
 import com.dreamchaser.depository_manage.service.MaterialService;
@@ -86,7 +87,11 @@ public class GroupController {
      */
     @PostMapping("/findGroupByCode")
     public RestResponse findGroupByCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前部门仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
         // 查询当前用户管理的仓库
@@ -359,7 +364,11 @@ public class GroupController {
     public RestResponse findGroupInfoByGid(@RequestBody Map<String, Object> map, HttpServletRequest request) {
 
 
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前部门仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
 
@@ -439,7 +448,11 @@ public class GroupController {
      */
     @PostMapping("/addApplicationToRedis")
     public RestResponse addApplicationToRedis(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取暂存的数据
         List<Integer> gids = (List<Integer>) map.get("gids");
         // 获取当前已经存在的数据
@@ -469,7 +482,11 @@ public class GroupController {
         Integer pagesize = ObjectFormatUtil.toInteger(map.get("size"));
         Integer start = (page - 1) * pagesize;
         Integer end = page * 10;
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Long size = redisTemplateForHash.boundListOps("wms_gids" + userToken.getId()).size();
         if (end > size) {
             end = ObjectFormatUtil.toInteger(size);
@@ -499,7 +516,11 @@ public class GroupController {
      */
     @PostMapping("/deleteApplicationToRedis")
     public RestResponse deleteApplicationToRedis(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<Integer> gids = (List<Integer>) map.get("gids");
         for (int i = 0; i < gids.size(); i++) {
             redisTemplateForHash.opsForList().remove("wms_gids" + userToken.getId(), 1, gids.get(i).toString());
@@ -517,7 +538,11 @@ public class GroupController {
      */
     @PostMapping("/applicationInForGroup")
     public RestResponse applicationInForGroup(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         // 获取当前提交数
@@ -548,7 +573,11 @@ public class GroupController {
 
     @PutMapping("/reviewIn")
     public RestResponse reviewIn(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Integer review = groupService.reviewIn(map, userToken.getId(), userToken, crypt);
@@ -569,7 +598,11 @@ public class GroupController {
      */
     @PostMapping("/applicationOutForGroup")
     public RestResponse applicationOutForGroup(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         map.put("applicantId", userToken.getId());
@@ -673,7 +706,11 @@ public class GroupController {
     @PostMapping("/groupQuantityIsTrue")
     public RestResponse groupQuantityIsTrue(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         if (map.containsKey("gid")) {
-            UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+            String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
             // 获取当前部门所拥有的仓库
             List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
             // 查询当前用户管理的仓库
@@ -714,7 +751,11 @@ public class GroupController {
      */
     @PostMapping("/createMultiApplication")
     public RestResponse createMultiApplication(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         map.put("applicantId", userToken.getId());
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/MaterialController.java b/src/main/java/com/dreamchaser/depository_manage/controller/MaterialController.java
index 07ecb22d..c6c45585 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/MaterialController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/MaterialController.java
@@ -7,6 +7,7 @@ import com.dreamchaser.depository_manage.config.JM_3DES;
 import com.dreamchaser.depository_manage.entity.*;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.*;
 import com.dreamchaser.depository_manage.utils.CrudUtil;
 import com.dreamchaser.depository_manage.utils.DateUtil;
@@ -72,7 +73,11 @@ public class MaterialController {
     @GetMapping("/findInventoryForStockTaking")
     public RestResponse findInventoryForStockTaking(@RequestParam Map<String, Object> map, HttpServletRequest request) {
         Integer depositoryId = ObjectFormatUtil.toInteger(map.get("depositoryId"));
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (Integer.compare(depositoryId, -1) == 0) {
             return new RestResponse(null);
         } else {
@@ -92,7 +97,11 @@ public class MaterialController {
      */
     @GetMapping("/findInventoryForGroup")
     public RestResponse findInventoryForGroup(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 查询当前用户部门拥有的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
         // 定义仓库编号列表
@@ -136,7 +145,11 @@ public class MaterialController {
      */
     @GetMapping("/findInventory")
     public RestResponse findInventory(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<InventoryP> list = new ArrayList<>();
         Integer total = 0;
         if (Integer.compare(userToken.getMaindeparment(), 361) != 0) {
@@ -293,7 +306,11 @@ public class MaterialController {
     public RestResponse InitTreeMenus(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         String mname = (String) map.get("mname");
         String type = (String) map.get("type");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer maindeparment = userToken.getMaindeparment();
         List<Object> list = new ArrayList<>();
         if (!"".equals(mname)) {
@@ -314,7 +331,11 @@ public class MaterialController {
      */
     @GetMapping("/findMatrialById")
     public RestResponse findMatrialById(@RequestParam(value = "mid", required = false) String mid, @RequestParam(value = "type", required = false) String type, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if ("".equals(mid)) {
             return new RestResponse("", 0, 200);
         }
@@ -369,7 +390,11 @@ public class MaterialController {
     public RestResponse findInventoryByIdAndPid(@RequestParam(value = "mid", required = false) String mid,
                                                 @RequestParam(value = "pid", required = false) String pid,
                                                 HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if ("".equals(mid)) {
             return new RestResponse("", 0, 200);
         }
@@ -422,7 +447,11 @@ public class MaterialController {
      */
     @GetMapping("/findMatrialByCode")
     public RestResponse findMatrialByCode(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前部门仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
         // 查询当前用户管理的仓库
@@ -515,7 +544,11 @@ public class MaterialController {
 
     @PostMapping("/findInventoryByCondition")
     public RestResponse findInventoryByCondition(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 查询当前用于部门的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
         // 查询当前用户管理的仓库
@@ -595,7 +628,11 @@ public class MaterialController {
     // 将扫描结果数据暂存到redis中
     @PostMapping("/temporaryValue")
     public RestResponse temporaryValue(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         ArrayList arrayList = (ArrayList) map.get("materialList");
         ArrayList materailList = new ArrayList();
         for (int i = 0; i < arrayList.size(); i++) {
@@ -611,7 +648,11 @@ public class MaterialController {
     // 将入库物料数据暂存到redis中
     @PostMapping("/temporaryValueForMaterial")
     public RestResponse temporaryValueForMaterial(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 存入mids
         redisTemplate.opsForValue().set("temporaryValueForMaterial" + userByPort.getNumber(), JSONObject.toJSONString(map));
         return new RestResponse(200);
@@ -620,7 +661,11 @@ public class MaterialController {
     // 将扫描的条形码数据暂存到redis中
     @PostMapping("/temporaryBarCodeValueForMaterial")
     public RestResponse temporaryBarCodeValueForMaterial(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 存入mids
         redisTemplate.opsForValue().set("temporaryBarCodeValueForMaterial" + userByPort.getNumber(), JSONObject.toJSONString(map));
         return new RestResponse(200);
@@ -629,7 +674,11 @@ public class MaterialController {
     // 判断当前扫描的物料是否存在
     @GetMapping("/IsMaterialExist")
     public RestResponse IsMaterialExist(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String scanQrCodeValue = redisTemplate.opsForValue().get("scanQrCodeValue" + userByPort.getNumber()).toString();
         redisTemplate.delete("scanQrCodeValue" + userByPort.getNumber());
         JSONObject jsonObject = JSONObject.parseObject(scanQrCodeValue);
@@ -674,7 +723,11 @@ public class MaterialController {
     //用于判断当前出库数量是否合适
     @PostMapping("/MaterialQuantityIsTrue")
     public RestResponse MaterialQuantityIsTrue(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 当前出库数量
         Integer quantity = ObjectFormatUtil.toInteger(map.get("quantity"));
         // 当前出库单位
@@ -790,7 +843,11 @@ public class MaterialController {
     // 获取扫描结果并跳转到入库
     @GetMapping("/application_in_scanQrCode")
     public RestResponse applicationInScanQrCode(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户所在部门拥有的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userByPort.getMaindeparment().toString());
         String scanQrCodeValue = redisTemplate.opsForValue().get("scanQrCodeValue" + userByPort.getNumber()).toString();
@@ -829,7 +886,11 @@ public class MaterialController {
     // 获取扫描结果并跳转到入库
     @PostMapping("/qywxApplicationInScanQrCode")
     public RestResponse qywxApplicationInScanQrCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户所在部门拥有的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userByPort.getMaindeparment().toString());
         // 获取当前扫描的码值
@@ -887,7 +948,11 @@ public class MaterialController {
     // 获取扫描结果并跳转到出库
     @PostMapping("/qywxApplicationOutScanQrCode")
     public RestResponse qywxApplicationOutScanQrCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户所在部门拥有的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userByPort.getMaindeparment().toString());
         // 查询当前用户管理的仓库
@@ -950,7 +1015,11 @@ public class MaterialController {
     // 获取扫描结果并跳转到盘点
     @PostMapping("/stockTaking_scanQrCode")
     public RestResponse stockTakingScanQrCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户所在部门拥有的仓库
         String scanQrCodeValue = redisTemplate.opsForValue().get("scanQrCodeValue" + userByPort.getNumber()).toString();
         redisTemplate.delete("scanQrCodeValue" + userByPort.getNumber());
@@ -1082,7 +1151,11 @@ public class MaterialController {
     // 获取条形码扫描结果
     @GetMapping("/application_in_scanBarCode")
     public RestResponse applicationInScanBarCode(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String scanBarCodeValue = redisTemplate.opsForValue().get("temporaryBarCodeValueForMaterial" + userByPort.getNumber()).toString();
         redisTemplate.delete("temporaryBarCodeValueForMaterial" + userByPort.getNumber());
         JSONObject jsonObject = JSONObject.parseObject(scanBarCodeValue);
@@ -1130,7 +1203,11 @@ public class MaterialController {
     // 获取企业微信条形码扫描结果
     @PostMapping("/qywxApplicationInScanBarCode")
     public RestResponse qywxApplicationInScanBarCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String qrCode = (String) map.get("qrCode");
         int codeFlag = ObjectFormatUtil.toInteger(map.get("codeFlag"));
         Map<String, Object> result = new HashMap<>();
@@ -1167,7 +1244,11 @@ public class MaterialController {
     // 获取条形码扫描结果
     @GetMapping("/application_transfer_scanBarCode")
     public RestResponse applicationTransferScanBarCode(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户部门所拥有仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userByPort.getMaindeparment().toString());
         String scanBarCodeValue = redisTemplate.opsForValue().get("temporaryBarCodeValueForMaterial" + userByPort.getNumber()).toString();
@@ -1219,7 +1300,11 @@ public class MaterialController {
     // 获取条形码扫描结果
     @PostMapping("/qywxApplicationOutScanBarCode")
     public RestResponse qywxApplicationOutScanBarCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String barCode = (String) map.get("qrCode");
         // 获取条形码与物料的映射
         MaterialAndBarCode materialByBarCode = materialService.findMaterialByBarCode(barCode);
@@ -1269,7 +1354,11 @@ public class MaterialController {
     // 获取条形码扫描结果
     @PostMapping("/stockTaking_scanBarCode")
     public RestResponse stockTakingScanBarCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取当前用户部门所拥有仓库
         String scanBarCodeValue = redisTemplate.opsForValue().get("temporaryBarCodeValueForMaterial" + userByPort.getNumber()).toString();
         redisTemplate.delete("temporaryBarCodeValueForMaterial" + userByPort.getNumber());
@@ -1389,7 +1478,11 @@ public class MaterialController {
 
     @PostMapping("/qywxStockTakingScanBarCode")
     public RestResponse qywxStockTakingScanBarCode(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         // 获取具体的条形码
         String barCode = (String) map.get("qrCode");
         Map<String, Object> result = new HashMap<>();
@@ -1469,7 +1562,11 @@ public class MaterialController {
     // 通过条形码获取物料信息
     @GetMapping("/findMaterialByBarCode")
     public RestResponse findMaterialByBarCode(@RequestParam String barCode, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         MaterialAndBarCode materialByBarCode = materialService.findMaterialByBarCode(barCode);
         Map<String, Object> map = new HashMap<>();
         if (materialByBarCode != null) {
@@ -1592,7 +1689,11 @@ public class MaterialController {
      */
     @PostMapping("/findMatrialByCodeForTaking")
     public RestResponse findMatrialByCodeForTaking(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前部门仓库
         Map<String, Object> param = new HashMap<>();
         String code = map.get("code").toString();
@@ -1757,7 +1858,11 @@ public class MaterialController {
     public RestResponse getNewTreeForMtId(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         String mname = (String) map.get("mname");
         String type = (String) map.get("type");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer maindeparment = userToken.getMaindeparment();
         Object mtId = map.get("mtId");
         List<Object> list = new ArrayList<>();
@@ -1864,7 +1969,11 @@ public class MaterialController {
             if("".equals(mid)){
                 return new RestResponse(null);
             }
-            UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+            String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
             // 获取当前部门所拥有的仓库
             List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
             // 查询当前用户管理的仓库
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/NoticeController.java b/src/main/java/com/dreamchaser/depository_manage/controller/NoticeController.java
index 97ee3eee..b0a89d1e 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/NoticeController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/NoticeController.java
@@ -8,6 +8,7 @@ import com.dreamchaser.depository_manage.entity.qywxDepartment;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.NoticeP;
 import com.dreamchaser.depository_manage.pojo.RestResponse;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.NoticeService;
 import com.dreamchaser.depository_manage.service.impl.QyWxOperationService;
 import com.dreamchaser.depository_manage.utils.CrudUtil;
@@ -37,7 +38,11 @@ public class NoticeController {
 
     @PostMapping("/notice")
     public RestResponse addNotice(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         map.put("userId", userByPort.getId());
         map.put("state", 1);
         // 获取插入结果
@@ -62,7 +67,11 @@ public class NoticeController {
 
     @GetMapping("/findAllNotices")
     public RestResponse findNotices(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         map.put("userAgent", crypt);
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/PageController.java b/src/main/java/com/dreamchaser/depository_manage/controller/PageController.java
index 58894fbe..849b9fe3 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/PageController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/PageController.java
@@ -9,6 +9,7 @@ import com.dreamchaser.depository_manage.entity.MaterialAndPlace;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
 import com.dreamchaser.depository_manage.security.bean.UserToken;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.*;
 import com.dreamchaser.depository_manage.utils.*;
 import org.apache.http.protocol.HTTP;
@@ -80,7 +81,11 @@ public class PageController {
     @GetMapping("/")
     public ModelAndView Init(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String userAgent = request.getHeader("user-agent");
         // 判断当前使用的设备为移动端还是pc端
         boolean b = DeviceUtil.checkAgentIsMobile(userAgent);
@@ -142,7 +147,11 @@ public class PageController {
     @GetMapping("/index")
     public ModelAndView index(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String userAgent = request.getHeader("user-agent");
         // 判断当前使用的设备为移动端还是pc端
         boolean b = DeviceUtil.checkAgentIsMobile(userAgent);
@@ -166,7 +175,11 @@ public class PageController {
     public Map<String, Object> index_menus(@RequestParam("uid") String uid,
                                            HttpServletRequest request,
                                            HttpServletResponse response) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         //定义链接地址
         String url = PortConfig.external_url_6666 + "/system_authorizing/obtain_authorization";
         Map<String, Object> param = new HashMap<>();
@@ -288,7 +301,11 @@ public class PageController {
     public ModelAndView welcome(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         String header = request.getHeader("user-agent");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         boolean b = DeviceUtil.checkAgentIsMobile(header);
         if (b) {
             mv.setViewName("pages/other/welcome_mobile");
@@ -328,6 +345,7 @@ public class PageController {
 
         Map<String, Object> paramForTask = new HashMap<>();
         paramForTask.put("isDone", 0);
+        paramForTask.put("userId", userToken.getId());
         paramForTask.put("departmentHead", userToken.getNumber());
 
         // 定义任务列表
@@ -346,6 +364,7 @@ public class PageController {
             SimpleTaskP simpleTaskP = new SimpleTaskP(simpleStockTakingP);
             list.add(simpleTaskP);
         }
+
         // 查询入库任务
         List<SimpleApplicationOutOrInRecordP> myTaskIn = depositoryRecordService.findMyTaskIn(paramForTask, userToken);
         for (SimpleApplicationOutOrInRecordP simpleApplicationOutOrInRecordP : myTaskIn) {
@@ -387,7 +406,11 @@ public class PageController {
 
     @GetMapping("/depository_add")
     public ModelAndView depository_add(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/warehouse/depository_add");
         Map<String, Object> administration = LinkInterfaceUtil.findAdministration(userByPort);
@@ -398,7 +421,11 @@ public class PageController {
 
     @GetMapping("/depository-out")
     public ModelAndView depository_out(HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/warehouse/depository-out");
         Map<String, Object> map = new HashMap<>();
@@ -434,7 +461,11 @@ public class PageController {
 
     @GetMapping("/split_out")
     public ModelAndView split_out(HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/split/split-out");
         Map<String, Object> map = new HashMap<>();
@@ -454,7 +485,11 @@ public class PageController {
     public ModelAndView material_out(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/material/material-out");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer isadmin = userToken.getIsadmin();
         // 获取当天时间戳
         String currentDate = DateUtil.getCurrentDate();
@@ -489,7 +524,11 @@ public class PageController {
     @GetMapping("/selectDepository")
     public ModelAndView selectDepository(Integer type, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (type == 1) {
             Integer maindeparment = userToken.getMaindeparment();
             mv.addObject("adminorg", maindeparment);
@@ -556,7 +595,11 @@ public class PageController {
     @GetMapping("/selectDepositoryByCard")
     public ModelAndView selectDepositoryByCard(Integer type, String clickObj, @RequestParam(value = "flagForGroup", required = false) boolean flagForGroup, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (type == 1) {
             Integer maindeparment = userToken.getMaindeparment();
             mv.addObject("adminorg", maindeparment);
@@ -629,7 +672,11 @@ public class PageController {
     public ModelAndView material_view(Integer id, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/material/material-view");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (id != null) {
             Material material = materialService.findMaterialById(id);
             Map<String, Object> map = new HashMap<>();
@@ -661,7 +708,11 @@ public class PageController {
         mv.setViewName("pages/materialtype/materialType_view");
         Map<String, Object> map = new HashMap<>();
         map.put("parentId", 0);
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer role = userToken.getIsadmin();
         if (role == null) {
             role = 1;
@@ -777,7 +828,11 @@ public class PageController {
     @GetMapping("/table_in")
     public ModelAndView table_in(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer isadmin = userToken.getIsadmin();
         if (isadmin == null) {
             isadmin = 1;
@@ -794,7 +849,11 @@ public class PageController {
     @GetMapping("/table_out")
     public ModelAndView table_out(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer isadmin = userToken.getIsadmin();
         if (isadmin == null) {
             isadmin = 1;
@@ -817,7 +876,11 @@ public class PageController {
 
     @GetMapping("/table_user")
     public ModelAndView table_user(HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/user/table-user");
         List<AdministrationP> administrationPList = findAllCompany(userToken);
@@ -899,7 +962,11 @@ public class PageController {
     public ModelAndView group_out(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/group/group-out");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer isadmin = userToken.getIsadmin();
         if (isadmin == null) {
             isadmin = 1;
@@ -941,7 +1008,11 @@ public class PageController {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/group/group_edit");
         Group group = groupService.findGroupOnlyById(id);
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer isadmin = userToken.getIsadmin();
         if (isadmin == null) {
             isadmin = 1;
@@ -966,7 +1037,11 @@ public class PageController {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/chart/chart-in_back");
 
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
         // 获取当前用户所在部门管理的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
@@ -1016,7 +1091,11 @@ public class PageController {
     public ModelAndView chart_out_back(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/chart/chart-out_back");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
         // 获取当前用户所在部门管理的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
@@ -1077,7 +1156,11 @@ public class PageController {
 
     @GetMapping("/user_add")
     public ModelAndView user_add(Integer userId, Integer classes, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/user/user-add");
         UserByPort userByPort = LinkInterfaceUtil.FindUserById(userId, userToken);
@@ -1089,7 +1172,11 @@ public class PageController {
 
     @GetMapping("/user_role_edit")
     public ModelAndView user_role_edit(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/user/user-role-edit");
         RoleAndDepository roleAndDepositoryById = roleService.findRoleAndDepositoryById(id);
@@ -1107,7 +1194,11 @@ public class PageController {
 
     @GetMapping("/post_role_edit")
     public ModelAndView post_role_edit(Integer id, Integer depositoryId, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/post/postRole_edit");
         Map<String, Object> userParam = new HashMap<>();
@@ -1129,7 +1220,11 @@ public class PageController {
 
     @GetMapping("/user_detail")
     public ModelAndView user_edit(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/user/user-edit");
         mv.addObject("depositories", depositoryService.findDepositoryAll());
@@ -1143,7 +1238,11 @@ public class PageController {
 
     @GetMapping("/warehouse_view")
     public ModelAndView warehouse_view(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/warehouse/warehouse_view");
         if (id != null) {
@@ -1167,7 +1266,11 @@ public class PageController {
 
     @GetMapping("/warehouseByParentId")
     public ModelAndView warehouseByParentId(Integer parentId, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/warehouse/warehouseByParentId");
         if (parentId != null) {
@@ -1225,7 +1328,11 @@ public class PageController {
 
     @GetMapping("/findWareHouseByParentId")
     public ModelAndView findWareHouseByParentId(Integer parentId, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         if (parentId != null) {
             Map<String, Object> param = new HashMap<>();
@@ -1315,7 +1422,11 @@ public class PageController {
 
     @GetMapping("/findMaterialTypeByParentId")
     public ModelAndView findMaterialTypeByParentId(Integer parentId, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         if (parentId != null) {
             Map<String, Object> param = new HashMap<>();
@@ -1361,7 +1472,11 @@ public class PageController {
 
     @GetMapping("/application_review")
     public ModelAndView application_review(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/application/application-review");
         // 获取主订单信息
@@ -1472,7 +1587,11 @@ public class PageController {
 
     @GetMapping("/form_step_look")
     public ModelAndView form_step_look(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/application/form-step-look");
         if (id != null) {
@@ -1537,7 +1656,11 @@ public class PageController {
 
     @GetMapping("/application_in_review")
     public ModelAndView application_in_review(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/application/form-step-look_in_review");
         if (id != null) {
@@ -1602,7 +1725,11 @@ public class PageController {
 
     @GetMapping("/form_step_lookByminRecordOut")
     public ModelAndView form_step_lookByminRecordOut(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/application/form-step-look_minRecordOut");
         if (id != null) {
@@ -1673,7 +1800,11 @@ public class PageController {
     // 跳转到出库详情
     @GetMapping("/ApplicationOutView")
     public ModelAndView ApplicationOutView(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/application/form-step-look_back");
         if (id != null) {
@@ -1848,7 +1979,11 @@ public class PageController {
     @GetMapping("/StockTakingReview")
     public ModelAndView StockTakingReview(Integer id, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
         // 获取盘点记录主表
         StockTaking stockTaking = stockTakingService.findStockTakingById(id);
@@ -1901,7 +2036,11 @@ public class PageController {
     @GetMapping("/StockTakingView")
     public ModelAndView StockTakingView(Integer id, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         mv.setViewName("pages/stockTaking/stockTakingView");
         // 获取盘点记录主表
         StockTaking stockTaking = stockTakingService.findStockTakingById(id);
@@ -1962,7 +2101,11 @@ public class PageController {
     public ModelAndView account_look(Integer id, HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/user/account-look");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<RoleAndDepository> depositoryAndRole = roleService.findDepositoryAndRole(userToken.getId());
         StringBuilder RoleName = new StringBuilder();
         StringBuilder DepositoryName = new StringBuilder();
@@ -2013,7 +2156,11 @@ public class PageController {
 
     @GetMapping("/company_out")
     public ModelAndView Company_Out(HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/company/company-out");
         List<AdministrationP> administrationPList = findAllCompany(userToken);
@@ -2035,7 +2182,11 @@ public class PageController {
 
     @GetMapping("/company_detail")
     public ModelAndView company_detail(Integer id, HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/getgovcont";
         Map<String, Object> map = new HashMap<>();
         ModelAndView mv = new ModelAndView();
@@ -2066,7 +2217,11 @@ public class PageController {
 
     @GetMapping("/findCompanyByParentId")
     public ModelAndView findCompanyByParentId(Integer parentId, Integer level, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         if (parentId != null) {
             mv.addObject("parentId", parentId);
@@ -2086,7 +2241,11 @@ public class PageController {
 
     @GetMapping("/findPostByOrganization")
     public ModelAndView findPostByOrganization(Integer organization, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/positionlist";
         ModelAndView mv = new ModelAndView();
         mv.addObject("parentId", organization);
@@ -2123,7 +2282,11 @@ public class PageController {
 
     @GetMapping("/post_detail")
     public ModelAndView post_detail(Integer id, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/post/post-view");
         if (id != null) {
@@ -2138,7 +2301,11 @@ public class PageController {
 
     @GetMapping("/findPostByParentId")
     public ModelAndView findPostByParentId(Integer parentId, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/org/positionlist";
         ModelAndView mv = new ModelAndView();
         if (parentId != null) {
@@ -2181,7 +2348,11 @@ public class PageController {
     // 跳转到添加权限界面
     @GetMapping("/postRoleAdd")
     public ModelAndView PostRoleAdd(Integer id, Integer classes, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/post/postRole_add");
         Post postById = LinkInterfaceUtil.findPostById(id, userToken);
@@ -2328,7 +2499,11 @@ public class PageController {
     @GetMapping("/application_in_scanQrCode")
     public ModelAndView applicationInScanQrCode(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String scanQrCodeValue = redisTemplate.opsForValue().get("scanQrCodeValue" + userByPort.getNumber()).toString();
         redisTemplate.delete("scanQrCodeValue" + userByPort.getNumber());
         JSONObject jsonObject = JSONObject.parseObject(scanQrCodeValue);
@@ -2352,7 +2527,11 @@ public class PageController {
     @GetMapping("/applicationInByMaterial")
     public ModelAndView applicationInByMaterial(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String scanQrCodeValue = redisTemplate.opsForValue().get("temporaryValueForMaterial" + userByPort.getNumber()).toString();
         redisTemplate.delete("temporaryValueForMaterial" + userByPort.getNumber());
         JSONObject jsonObject = JSONObject.parseObject(scanQrCodeValue);
@@ -2386,7 +2565,11 @@ public class PageController {
     @GetMapping("/application_Out_scanQrCode")
     public ModelAndView applicationOutScanQrCode(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String scanQrCodeValue = redisTemplate.opsForValue().get("scanQrCodeValue" + userByPort.getNumber()).toString();
         redisTemplate.delete("scanQrCodeValue" + userByPort.getNumber());
         JSONObject jsonObject = JSONObject.parseObject(scanQrCodeValue);
@@ -2441,7 +2624,11 @@ public class PageController {
     // 跳转至库存盘点页面
     @GetMapping("/stockTaking")
     public ModelAndView stockTaking(HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         // 获取仓储中心详情
 //        Administration company = LinkInterfaceUtil.getCompany(361, userToken);
@@ -2476,7 +2663,11 @@ public class PageController {
     // 用于打开盘点后物料转移页面
     @GetMapping("/stockTakingTransfer")
     public ModelAndView stockTakingTransfer(String minIds, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         ModelAndView mv = new ModelAndView();
         List<StockTakingChildP> takingChildPS = new ArrayList<>();
         StockTaking stockTaking = null;
@@ -2628,7 +2819,11 @@ public class PageController {
         mv.setViewName("pages/notice/notice-view");
 
         NoticeP noticeById = noticeService.findNoticeById(id);
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (Integer.compare(noticeById.getUserId(), userToken.getId()) == 0) {
             String header = request.getHeader("user-agent");
             String crypt = Md5.crypt(header);
@@ -2659,7 +2854,11 @@ public class PageController {
     public ModelAndView noticeAll(HttpServletRequest request) {
         ModelAndView mv = new ModelAndView();
         mv.setViewName("pages/notice/notice-out_user");
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         mv.addObject("userId", userToken.getId());
         Integer role = userToken.getIsadmin();
         if (role == null) {
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/PlaceController.java b/src/main/java/com/dreamchaser/depository_manage/controller/PlaceController.java
index 8e10058e..ce5a7c7a 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/PlaceController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/PlaceController.java
@@ -5,6 +5,7 @@ import com.dreamchaser.depository_manage.entity.*;
 import com.dreamchaser.depository_manage.entity.MaterialAndPlace;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.pojo.*;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.DepositoryService;
 import com.dreamchaser.depository_manage.service.MaterialService;
 import com.dreamchaser.depository_manage.service.PlaceService;
@@ -328,7 +329,11 @@ public class PlaceController {
     // 根据物料编号获取库位
     @PostMapping("/findPlaceByMid")
     public RestResponse findPlaceByMid(@RequestBody Map<String,Object> map, HttpServletRequest request){
-        UserByPort userToken= (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 查询当前用户部门所拥有的仓库
         List<Depository> depositoryByAdminorg = depositoryService.findDepositoryByAdminorg(userToken.getMaindeparment().toString());
         // 查询当前用户管理的仓库
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/QyWxOperationController.java b/src/main/java/com/dreamchaser/depository_manage/controller/QyWxOperationController.java
index 766edb60..2ae34f36 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/QyWxOperationController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/QyWxOperationController.java
@@ -289,7 +289,7 @@ public class QyWxOperationController {
                     UserKeyAndTokenPool.addKeyAndToken(userByPort.getNumber(), keyAndToken);
                     // 设置放入时间
                     userByPort.setInstant(Instant.now());
-                    AuthenticationTokenPool.addToken(token, userByPort);
+                    AuthenticationTokenPool.addUserToken(token, userByPort);
                     HttpSession session = request.getSession();
                     session.setAttribute("token" + userByPort.getId(), token);
                     session.setAttribute("userToken", userByPort);
@@ -337,7 +337,11 @@ public class QyWxOperationController {
         // 随机字符串
 
 
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
 
         Map<String, String> result = new HashMap<>();
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/StockTakingController.java b/src/main/java/com/dreamchaser/depository_manage/controller/StockTakingController.java
index 8e749476..2ecb9ce6 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/StockTakingController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/StockTakingController.java
@@ -10,6 +10,7 @@ import com.dreamchaser.depository_manage.entity.UserByPort;
 import com.dreamchaser.depository_manage.pojo.RestResponse;
 import com.dreamchaser.depository_manage.pojo.SimpleStockTakingP;
 import com.dreamchaser.depository_manage.pojo.StatusInfo;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.MaterialService;
 import com.dreamchaser.depository_manage.service.MaterialTypeService;
 import com.dreamchaser.depository_manage.service.PlaceService;
@@ -55,7 +56,11 @@ public class StockTakingController {
     @PostMapping("/addStockTakingRecord")
     public RestResponse addStockTakingRecord(@RequestBody Map<String, Object> map, HttpServletRequest request) {
 
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
@@ -202,7 +207,11 @@ public class StockTakingController {
     // 用于查询需要用户审核的盘点
     @GetMapping("/myTask")
     public RestResponse myTask(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("departmentHead", userToken.getNumber());
         List<SimpleStockTakingP> myTask = stockTakingService.findMyTask(map, request);
         return new RestResponse(myTask, stockTakingService.findMyTaskCount(map), 200);
@@ -213,7 +222,11 @@ public class StockTakingController {
     public RestResponse review(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Map<String, Object> review = stockTakingService.review(map, userToken, crypt);
 
         if (review.containsKey("errMsg")) {
@@ -228,7 +241,11 @@ public class StockTakingController {
     // 用于完成订单
     @PostMapping("/complete")
     public RestResponse complete(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         Map<String, Object> complete = stockTakingService.completeStockTaking(map, userToken, crypt);
@@ -243,7 +260,11 @@ public class StockTakingController {
     // 用于查询用户提交的盘点
     @GetMapping("/myApply")
     public RestResponse myApply(@RequestParam Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         map.put("userId", userToken.getId());
         List<SimpleStockTakingP> myTask = stockTakingService.findMyApply(map, request);
         return new RestResponse(myTask, stockTakingService.findMyApplyCount(map), 200);
@@ -253,7 +274,11 @@ public class StockTakingController {
     // 用于查询转入位置的容量
     @PostMapping("/findInventoryByLocation")
     public RestResponse findInventoryByLocation(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String depositoryId = (String) map.get("depositoryId");
         String placeId = (String) map.get("placeId");
         // 获取当前库位
@@ -268,7 +293,11 @@ public class StockTakingController {
     @PostMapping("/stockTransfer")
     public RestResponse stockTransfer(@RequestBody Map<String, Object> map, HttpServletRequest request) {
 
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
         String minIds = (String) map.get("minIds");
@@ -290,7 +319,11 @@ public class StockTakingController {
     @PostMapping("/temporaryStorageForTakingResult")
     public void temporaryStorageForTakingResult(@RequestBody Map<String, Object> map, HttpServletRequest request) {
         // 获取当前盘点人
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         // 获取当前暂存的结果id
         String key = "wms_stockTaking_" + userToken.getId() + "_" + DateUtil.getNowTime() + "_" + map.get("id");
         map.put("flagForSubmit", "false");
@@ -303,7 +336,11 @@ public class StockTakingController {
 
     @PostMapping("/submitStockTaking")
     public RestResponse submitStockTaking(@RequestBody Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
 
         String header = request.getHeader("user-agent");
         String crypt = Md5.crypt(header);
diff --git a/src/main/java/com/dreamchaser/depository_manage/controller/UserController.java b/src/main/java/com/dreamchaser/depository_manage/controller/UserController.java
index 8379adda..b21744a9 100644
--- a/src/main/java/com/dreamchaser/depository_manage/controller/UserController.java
+++ b/src/main/java/com/dreamchaser/depository_manage/controller/UserController.java
@@ -24,6 +24,7 @@ import com.dreamchaser.depository_manage.service.UserService;
 import com.dreamchaser.depository_manage.utils.*;
 import org.apache.http.protocol.HTTP;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletRequest;
@@ -35,6 +36,7 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.TimeUnit;
 
 import static com.dreamchaser.depository_manage.utils.CrudUtil.deleteHandle;
 
@@ -57,6 +59,10 @@ public class UserController {
     @Autowired
     private DepositoryService depositoryService;
 
+
+    @Autowired
+    private RedisTemplate<String, String> redisTemplate;
+
     /**
      * 注册用户（通常为手机或者邮箱注册）
      *
@@ -130,63 +136,63 @@ public class UserController {
      * 登录接口
      *
      * @param map 登录信息
-     *            loginType 登录方式，目前支持的有email,qq,wechat
-     *            principal 主要认证主体，如账号，邮箱，qq的openID，wechat的code等
-     *            credentials 类似于密码，如果是qq，wechat则不需要传改参数
      *            restResponse，附带凭证token
      */
     @PostMapping("/login")
-    public RestResponse login(@RequestBody Map<String, String> map, HttpServletRequest request,HttpServletResponse response) {
+    public RestResponse login(@RequestBody Map<String, String> map, HttpServletRequest request, HttpServletResponse response) {
         response.setHeader("Access-Control-Allow-Origin", "*");
         String userWxId = map.get("userWxId");
         // 用于标识当前登录是否为企业微信跳转登录
         boolean flag = true;
-        if(!"".equals(userWxId)){
+        if (!"".equals(userWxId)) {
             // 如果是企业微信跳转
             flag = false;
         }
-        String url = PortConfig.external_url_6666 +"/base/login";
+        String url = PortConfig.external_url_6666 + "/base/login";
         String jsonString = JSONObject.toJSONString(map);
         JSONObject paramObject = JSONObject.parseObject(jsonString);
         String post = null;
         try {
-            post = HttpUtils.send(url,paramObject, HTTP.UTF_8,null);
+            post = HttpUtils.send(url, paramObject, HTTP.UTF_8, null);
         } catch (IOException e) {
             e.printStackTrace();
         }
         JSONObject jsonObject = JSONObject.parseObject(post);
         JSONObject data = (JSONObject) jsonObject.get("data");
         String userkey = (String) data.get("key");
-        if(userkey != null) {
+        if (userkey != null) {
             String userToken = (String) data.get("token");
 
-            String keyAndToken = userkey + "&" +userToken;
+            String keyAndToken = userkey + "&" + userToken;
             UserByPort userinfo = JSONObject.toJavaObject((JSONObject) data.get("userinfo"), UserByPort.class);
 
             // 将key与token暂存至池中保存
-            UserKeyAndTokenPool.addKeyAndToken(userinfo.getNumber(),keyAndToken);
-
-            AuthenticationTokenPool.addToken(userToken,userinfo);
-            HttpSession session = request.getSession();
-            session.setAttribute("token"+userinfo.getId(),userToken);
-            session.setAttribute("userToken",userinfo);
-            session.setMaxInactiveInterval(1800);
-            if(!flag){
+            UserKeyAndTokenPool.addKeyAndToken(userinfo.getNumber(), keyAndToken);
+            // 将登录用户存储到池中保存
+            AuthenticationTokenPool.addUserToken(userToken, userinfo);
+            // 将key与token设置到session中
+            request.getSession().setAttribute("userKey", userkey);
+            request.getSession().setAttribute("userToken", userToken);
+            request.getSession().setMaxInactiveInterval(3 * 60 * 60);
+            redisTemplate.opsForValue().set(userkey, userToken);
+            redisTemplate.expire(userkey, 3 * 60 * 60, TimeUnit.SECONDS);
+            if (!flag) {
                 // 如果是企业微信跳转
-                Map<String,String> param = new HashMap<>();
-                param.put("id",userinfo.getId().toString());
-                param.put("workwechatid",userWxId);
+                Map<String, String> param = new HashMap<>();
+                param.put("id", userinfo.getId().toString());
+                param.put("workwechatid", userWxId);
                 // 将openid写回
-                PortConfig.editUserWechatOpenid(map,userinfo);
+                PortConfig.editUserWechatOpenid(param, userinfo);
             }
             // 设置放入时间
             userinfo.setInstant(Instant.now());
-            return new RestResponse(userToken);
-        }else{
+            return new RestResponse(data);
+        } else {
             return CrudUtil.NOT_EXIST_USER_OR_ERROR_PWD_RESPONSE;
         }
 
     }
+
     /**
      * 将生成的令牌拿去认证，如果认证成功则返回带有token凭证响应，否则返回用户密码错误的响应
      *
@@ -201,14 +207,16 @@ public class UserController {
             return CrudUtil.NOT_EXIST_USER_OR_ERROR_PWD_RESPONSE;
         }
     }
+
     @GetMapping("/loginOut")
-    public RestResponse loginOut(HttpServletRequest request){
+    public RestResponse loginOut(HttpServletRequest request) {
         HttpSession session = request.getSession();
+        String userKey = (String) session.getAttribute("userKey");
+        String userToken = (String) session.getAttribute("userToken");
         session.invalidate();
-        request.removeAttribute("userToken");
-//        session.removeAttribute("token");
-//        AuthenticationTokenPool.removeToken(token);
-        return new RestResponse("",200,new StatusInfo("退出成功","退出成功"));
+        AuthenticationTokenPool.removeUserToken(userToken);
+        redisTemplate.delete(userKey);
+        return new RestResponse("", 200, new StatusInfo("退出成功", "退出成功"));
     }
 
 
@@ -221,7 +229,6 @@ public class UserController {
     public RestResponse logout() {
         return new RestResponse("",200,new StatusInfo("退出成功","退出成功"));
     }*/
-
     @GetMapping("/sys/users")
     public RestResponse findUsers(@RequestParam Map<String, Object> map) {
         return new RestResponse(userService.findUserPsByCondition(map), userService.findCount(), 200);
@@ -229,53 +236,58 @@ public class UserController {
 
     /**
      * 获取人员列表
+     *
      * @param map
      * @return
      */
     @PostMapping("/sys/findUsers")
-    public RestResponse findUsersByPort(@RequestParam Map<String, Object> map,HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+    public RestResponse findUsersByPort(@RequestParam Map<String, Object> map, HttpServletRequest request) {
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url + "/staff/archiveslist";
-        if(map.containsKey("company")){
-            map.put("company",ObjectFormatUtil.toInteger(map.get("company")));
+        if (map.containsKey("company")) {
+            map.put("company", ObjectFormatUtil.toInteger(map.get("company")));
         }
-        if(map.containsKey("adminorg")){
-            map.put("adminorg",ObjectFormatUtil.toInteger(map.get("adminorg")));
+        if (map.containsKey("adminorg")) {
+            map.put("adminorg", ObjectFormatUtil.toInteger(map.get("adminorg")));
         }
         Object page = map.get("page");
         Object pagesize = map.get("pagesize");
-        map.put("page",ObjectFormatUtil.toInteger(page));
-        map.put("pagesize",ObjectFormatUtil.toInteger(pagesize));
+        map.put("page", ObjectFormatUtil.toInteger(page));
+        map.put("pagesize", ObjectFormatUtil.toInteger(pagesize));
         String jsonString = JSONObject.toJSONString(map);
         JSONObject paramObject = JSONObject.parseObject(jsonString);
         String post = null;
         try {
-           post = HttpUtils.send(url,paramObject, HTTP.UTF_8,userToken);
+            post = HttpUtils.send(url, paramObject, HTTP.UTF_8, userToken);
         } catch (IOException e) {
             e.printStackTrace();
         }
         JSONObject jsonObject = JSONObject.parseObject(post);
         JSONObject data = (JSONObject) jsonObject.get("data");
         JSONArray list = (JSONArray) data.get("list");
-        if(list == null){
+        if (list == null) {
             list = new JSONArray();
         }
         Integer total = ObjectFormatUtil.toInteger(data.get("total"));
         List<UserByPortP> userByPortList = new ArrayList<>();
         for (int i = 0; i < list.size(); i++) {
-            UserByPort userByPort = JSONObject.toJavaObject((JSONObject)list.get(i), UserByPort.class);
+            UserByPort userByPort = JSONObject.toJavaObject((JSONObject) list.get(i), UserByPort.class);
             UserByPortP user = new UserByPortP(userByPort);
-            Map<String,Object> param = new HashMap<>();
-            param.put("userId",userByPort.getId());
-            param.put("classes",1);
+            Map<String, Object> param = new HashMap<>();
+            param.put("userId", userByPort.getId());
+            param.put("classes", 1);
             List<RoleAndDepository> roleAndDepositoryByCondition = roleService.findRoleAndDepositoryByCondition(param);
             RoleAndDepository depositoryAndRole = null;
-            if(roleAndDepositoryByCondition.size() > 0){
+            if (roleAndDepositoryByCondition.size() > 0) {
                 depositoryAndRole = roleAndDepositoryByCondition.get(0);
             }
-            if(depositoryAndRole != null && depositoryAndRole.getClasses() != 2) {
+            if (depositoryAndRole != null && depositoryAndRole.getClasses() != 2) {
                 user.setDepositoryName(depositoryAndRole.getDepositoryName());
-            }else{
+            } else {
                 user.setDepositoryName("");
             }
             userByPortList.add(user);
@@ -294,19 +306,19 @@ public class UserController {
      */
     @PostMapping("/sys/user_role")
     public RestResponse addUser(@RequestBody Map<String, Object> map) {
-        Map<String,Object> param = new HashMap<>();
-        param.put("userId",map.get("userid"));
-        param.put("classes",map.get("classes"));
-        if(map.containsKey("depositoryId")){
-            param.put("depositoryId",map.get("depositoryId"));
+        Map<String, Object> param = new HashMap<>();
+        param.put("userId", map.get("userid"));
+        param.put("classes", map.get("classes"));
+        if (map.containsKey("depositoryId")) {
+            param.put("depositoryId", map.get("depositoryId"));
             List<RoleAndDepository> roleAndDepositoryByCondition = roleService.findRoleAndDepositoryByCondition(param);
-            if(roleAndDepositoryByCondition.size() > 0){
-                return  CrudUtil.postHandle(-1,-1);
-            }else{
+            if (roleAndDepositoryByCondition.size() > 0) {
+                return CrudUtil.postHandle(-1, -1);
+            } else {
                 Integer integer = roleService.addUserOrPostRoleAndDepository(map);
                 return CrudUtil.postHandle(integer, integer);
             }
-        }else{
+        } else {
             List<Depository> depositoryAll = depositoryService.findDepositoryAll();
             Integer success = 0;
             for (Depository depository : depositoryAll) {
@@ -317,14 +329,14 @@ public class UserController {
                     success += roleService.addUserOrPostRoleAndDepository(map);
                 }
             }
-            return CrudUtil.postHandle(success,depositoryAll.size());
+            return CrudUtil.postHandle(success, depositoryAll.size());
         }
 
     }
 
     @PostMapping("/sys/userRole_edit")
     public RestResponse editUserRole(@RequestBody Map<String, Object> map) {
-        return CrudUtil.postHandle(roleService.UpdateRoleAndDepositoryById(map),1);
+        return CrudUtil.postHandle(roleService.UpdateRoleAndDepositoryById(map), 1);
     }
 
     @PostMapping("/sys/user_detail")
@@ -358,24 +370,24 @@ public class UserController {
 
     /**
      * 根据主键删除权限类型
+     *
      * @param map
      * @return
      */
     @PostMapping("/sys/userRole_del")
-    public RestResponse deleteRoleAndDepository(@RequestBody Map<String,Object> map){
-        if(map.containsKey("id")) {
+    public RestResponse deleteRoleAndDepository(@RequestBody Map<String, Object> map) {
+        if (map.containsKey("id")) {
             Integer id = ObjectFormatUtil.toInteger(map.get("id"));
             return CrudUtil.deleteHandle(roleService.deleteRoleAndDepositoryById(id), 1);
-        }
-        else if(map.containsKey("ids")){
+        } else if (map.containsKey("ids")) {
             Integer num = 0;
-            List<Integer> ids=(List<Integer>) map.get("ids");
+            List<Integer> ids = (List<Integer>) map.get("ids");
             for (int i = 0; i < ids.size(); i++) {
                 Integer id = ids.get(i);
                 num += roleService.deleteRoleAndDepositoryById(id);
             }
             return CrudUtil.deleteHandle(num, ids.size());
-        }else {
+        } else {
             throw new MyException("所需请求参数缺失！");
         }
     }
@@ -421,8 +433,6 @@ public class UserController {
     }
 
 
-
-
     /**
      * 用于注册用户的方法，主要为号码验证和邮箱验证提供验证码核对的服务
      *
@@ -441,7 +451,6 @@ public class UserController {
     }
 
 
-
     /**
      * 修改用户密码
      *
@@ -466,10 +475,11 @@ public class UserController {
 
     /**
      * 获取验证码
+     *
      * @return
      */
     @GetMapping("/getCaptchaid")
-    public JSONObject getCaptchaid(HttpServletRequest httpServletRequest, HttpServletResponse response){
+    public JSONObject getCaptchaid(HttpServletRequest httpServletRequest, HttpServletResponse response) {
         response.setHeader("Access-Control-Allow-Origin", "*");
         JSONObject captcha = LinkInterfaceUtil.Captcha(httpServletRequest);
         return captcha;
@@ -477,14 +487,18 @@ public class UserController {
 
 
     @PostMapping("/accountLook")
-    public RestResponse accountLook(HttpServletRequest request){
+    public RestResponse accountLook(HttpServletRequest request) {
         Object userToken = request.getAttribute("userToken");
         return new RestResponse(userToken);
     }
 
     @GetMapping("/findUserRole")
-    public RestResponse findUserRole(@RequestParam Map<String,Object> map,HttpServletRequest request){
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+    public RestResponse findUserRole(@RequestParam Map<String, Object> map, HttpServletRequest request) {
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         List<UserByPortP> userByPortPList = new ArrayList<>();
         List<RoleAndDepository> roleAndDepositoryByCondition = roleService.findRoleAndDepositoryByCondition(map);
         for (RoleAndDepository roleAndDepository : roleAndDepositoryByCondition) {
@@ -498,8 +512,4 @@ public class UserController {
     }
 
 
-
-
-
-
 }
diff --git a/src/main/java/com/dreamchaser/depository_manage/entity/UserByPort.java b/src/main/java/com/dreamchaser/depository_manage/entity/UserByPort.java
index d6f17b2c..93db1344 100644
--- a/src/main/java/com/dreamchaser/depository_manage/entity/UserByPort.java
+++ b/src/main/java/com/dreamchaser/depository_manage/entity/UserByPort.java
@@ -6,13 +6,13 @@ import java.time.Instant;
 
 @Data
 public class UserByPort {
-//    登录令牌，默认有效期为两小时
-    final long DEFAULT_TERM=60*60*3;
+    //    登录令牌，默认有效期为三小时
+    final long DEFAULT_TERM = 60 * 60 * 3;
 
 
     /**
      * id
-      */
+     */
     private Integer id;
 
     /**
@@ -236,7 +236,7 @@ public class UserByPort {
     private String veteransnumber;
 
     /**
-     *  参加工作日期
+     * 参加工作日期
      */
     private Long jobstartdate;
 
@@ -252,7 +252,7 @@ public class UserByPort {
 
     /**
      * 预计转正日期
-      */
+     */
     private Long planformaldate;
 
     /**
@@ -304,12 +304,12 @@ public class UserByPort {
 
     /**
      * 根据时间判断是否有效
+     *
      * @return 有效则返回true，否则返回false
      */
-    public boolean isValid(){
-        return Instant.now().getEpochSecond()-instant.getEpochSecond()<=term;
+    public boolean isValid() {
+        return Instant.now().getEpochSecond() - instant.getEpochSecond() <= term;
     }
 
 
-
 }
diff --git a/src/main/java/com/dreamchaser/depository_manage/intercepter/UserInterceptor.java b/src/main/java/com/dreamchaser/depository_manage/intercepter/UserInterceptor.java
index e196c52d..33f6b736 100644
--- a/src/main/java/com/dreamchaser/depository_manage/intercepter/UserInterceptor.java
+++ b/src/main/java/com/dreamchaser/depository_manage/intercepter/UserInterceptor.java
@@ -4,69 +4,91 @@ import com.dreamchaser.depository_manage.config.QyWxConfig;
 import com.dreamchaser.depository_manage.entity.UserByPort;
 import com.dreamchaser.depository_manage.exception.MyException;
 import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
-import com.dreamchaser.depository_manage.utils.HttpUtils;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.mobile.device.Device;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.ModelAndView;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 import java.io.IOException;
-import java.util.Enumeration;
+import java.util.ArrayList;
+import java.util.List;
 
 /**
  * 认证拦截器，如果请求头中有相应凭证则放行，否则拦截返回认证失效错误
+ *
  * @author 金昊霖
  */
 @Slf4j
 @Component
 public class UserInterceptor extends HandlerInterceptorAdapter {
 
+    private static final List<String> pathList = new ArrayList<String>() {
+        {
+            add("/getMaterialAll");
+            add("/getCaptchaid");
+            add("/QyWxLogin");
+        }
+    };
+    private static RedisTemplate<String, String> redisTemplate;
+
+    @Autowired
+    public void setRedisTemplate(RedisTemplate<String, String> redisTemplate) {
+        UserInterceptor.redisTemplate = redisTemplate;
+    }
+
     @Override
     public boolean preHandle(HttpServletRequest request,
                              HttpServletResponse response, Object handler) throws MyException {
         String header = request.getHeader("user-agent");
-        String token =null;
+        String token = null;
         String servletPath = request.getServletPath();
-        HttpSession session = request.getSession();
-        UserByPort userByPort = (UserByPort) session.getAttribute("userToken");
-        if(userByPort!=null){
-            token = (String) session.getAttribute("token"+userByPort.getId());
-        }else{
-            token = request.getHeader("user-token");
-        }
+
         //如果是访问logout则删除对应的令牌
-        if ("/loginOut".equals(request.getServletPath())){
-            AuthenticationTokenPool.removeToken(token);
-            session.invalidate();
+        if ("/loginOut".equals(servletPath)) {
             return true;
         }
-        if("/getMaterialAll".equals(request.getServletPath())){
+        if (pathList.contains(servletPath)) {
             return true;
         }
-        if("/getCaptchaid".equals(request.getServletPath())){
-            return true;
+        String userKey = request.getHeader("user-key");
+        String userToken = request.getHeader("user-token");
+        if (userKey == null) {
+            userKey = (String) request.getSession().getAttribute("userKey");
+            userToken = (String) request.getSession().getAttribute("userToken");
         }
-        if("/QyWxLogin".equals(request.getServletPath())){
-            return true;
+        if (userKey == null || userToken == null) {
+//            throw new MyException("未登录或登录过期，请重新登录");
+            userKey = "";
+        }
+        token = redisTemplate.opsForValue().get(userKey);
+        if (token == null || !token.equals(userToken)) {
+            try {
+                response.sendRedirect("/login");
+            } catch (IOException e) {
+                e.printStackTrace();
+            }
+            return false;
         }
-        if (!"".equals(token) &&token!=null&&AuthenticationTokenPool.getToken(token)!=null){
-            request.setAttribute("userToken",AuthenticationTokenPool.getToken(token));
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
+        if (!"".equals(token) && userByPort != null) {
+            AuthenticationTokenPool.addUserToken(token, userByPort);
             return true;
-        }else {
+        } else {
             try {
-                if(isMobileDevice(request)){
-                    if(header.contains("wxwork")) {
+                if (isMobileDevice(request)) {
+                    if (header.contains("wxwork")) {
                         // 如果是企业微信跳转
                         response.sendRedirect(QyWxConfig.getQYWXCodeUrl());
-                    }else{
+                    } else {
 
                         response.sendRedirect("/login");
                     }
-                }else {
+                } else {
                     response.sendRedirect("/login");
                 }
             } catch (IOException e) {
@@ -77,16 +99,12 @@ public class UserInterceptor extends HandlerInterceptorAdapter {
     }
 
 
-
     public boolean isMobileDevice(HttpServletRequest request) {
         String requestHeader = request.getHeader("user-agent").toLowerCase();
         String[] deviceArray = new String[]{"android", "iphone", "ios", "windows phone"};
-        if (requestHeader == null) {
-            return false;
-        }
         requestHeader = requestHeader.toLowerCase();
-        for (int i = 0; i < deviceArray.length; i++) {
-            if (requestHeader.indexOf(deviceArray[i]) > 0) {
+        for (String s : deviceArray) {
+            if (requestHeader.indexOf(s) > 0) {
                 return true;
             }
         }
@@ -94,7 +112,4 @@ public class UserInterceptor extends HandlerInterceptorAdapter {
     }
 
 
-
-
-
 }
diff --git a/src/main/java/com/dreamchaser/depository_manage/security/bean/LoginRealms.java b/src/main/java/com/dreamchaser/depository_manage/security/bean/LoginRealms.java
index 9efdbb13..be3807db 100644
--- a/src/main/java/com/dreamchaser/depository_manage/security/bean/LoginRealms.java
+++ b/src/main/java/com/dreamchaser/depository_manage/security/bean/LoginRealms.java
@@ -10,7 +10,6 @@ import org.springframework.stereotype.Component;
 
 /**
  * 内置多种登录方式，和shiro中的realm类似
- * @author 金昊霖
  */
 @Component
 public class LoginRealms {
diff --git a/src/main/java/com/dreamchaser/depository_manage/security/pool/AuthenticationTokenPool.java b/src/main/java/com/dreamchaser/depository_manage/security/pool/AuthenticationTokenPool.java
index a44313d5..ab2833ad 100644
--- a/src/main/java/com/dreamchaser/depository_manage/security/pool/AuthenticationTokenPool.java
+++ b/src/main/java/com/dreamchaser/depository_manage/security/pool/AuthenticationTokenPool.java
@@ -14,60 +14,45 @@ public class AuthenticationTokenPool {
     /**
      * 认证后的令牌连接池
      */
-//    private static Map<String, UserToken> pool=new ConcurrentHashMap<>(10);
     private static Map<String, UserByPort> pool = new ConcurrentHashMap<>(100);
 
-    public static void addToken(String token,UserByPort userToken){
+    public static void addUserToken(String token, UserByPort userToken) {
         pool.put(token, userToken);
     }
-    /*public static void addToken(String token,UserToken userToken){
-        pool.put(token, userToken);
-    }*/
 
     /**
      * 根据token凭证获取未过期的令牌，如果没有未过期的令牌则返回null
+     *
      * @param token 凭证
      * @return userToken 未过期的令牌
      */
-       public static UserByPort getToken(String token){
-           UserByPort userToken=pool.get(token);
-
-        //如果没有相应令牌则直接返回null
-        if (userToken==null){
+    public static UserByPort getUserToken(String token) {
+        if(token == null){
             return null;
         }
-
-        //判断令牌是否过期
-        if (userToken.isValid()){
-            return userToken;
-        }else{
-            //清除过期令牌
-            pool.remove(token);
-            return null;
-        }
-    }
-   /* public static UserToken getToken(String token){
-        UserToken userToken=pool.get(token);
+        UserByPort userToken = pool.get(token);
 
         //如果没有相应令牌则直接返回null
-        if (userToken==null){
+        if (userToken == null) {
             return null;
         }
 
         //判断令牌是否过期
-        if (userToken.isValid()){
+        if (userToken.isValid()) {
             return userToken;
-        }else{
+        } else {
             //清除过期令牌
             pool.remove(token);
             return null;
         }
-    }*/
+    }
+
     /**
      * 根据凭证删除对应的令牌
+     *
      * @param token 凭证
      */
-    public static void removeToken(String token){
+    public static void removeUserToken(String token) {
         pool.remove(token);
     }
 
diff --git a/src/main/java/com/dreamchaser/depository_manage/service/impl/StockTakingServiceImpl.java b/src/main/java/com/dreamchaser/depository_manage/service/impl/StockTakingServiceImpl.java
index 92c8aac0..48f2036d 100644
--- a/src/main/java/com/dreamchaser/depository_manage/service/impl/StockTakingServiceImpl.java
+++ b/src/main/java/com/dreamchaser/depository_manage/service/impl/StockTakingServiceImpl.java
@@ -9,6 +9,7 @@ import com.dreamchaser.depository_manage.pojo.*;
 import com.dreamchaser.depository_manage.pojo.callBackXml.approvalCallBackXml.ApprovalInfo_Details;
 import com.dreamchaser.depository_manage.pojo.callBackXml.approvalCallBackXml.ApprovalInfo_Details_Approver;
 import com.dreamchaser.depository_manage.pojo.callBackXml.callBackXml_button_templatecard.TemplateCard;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import com.dreamchaser.depository_manage.service.DepositoryRecordService;
 import com.dreamchaser.depository_manage.service.SplitUnitService;
 import com.dreamchaser.depository_manage.service.StockTakingService;
@@ -238,7 +239,11 @@ public class StockTakingServiceImpl implements StockTakingService {
      */
     @Override
     public List<SimpleStockTakingP> findMyTask(Map<String, Object> map, HttpServletRequest request) {
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         Integer size = 10, page = 1;
         if (map.containsKey("size")) {
             size = ObjectFormatUtil.toInteger(map.get("size"));
@@ -283,7 +288,11 @@ public class StockTakingServiceImpl implements StockTakingService {
     @Override
     public List<SimpleStockTakingP> findMyApply(Map<String, Object> map, HttpServletRequest request) {
         Integer size = 10, page = 1;
-        UserByPort userToken = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userToken = AuthenticationTokenPool.getUserToken(token);
         if (map.containsKey("size")) {
             size = ObjectFormatUtil.toInteger(map.get("size"));
             map.put("size", size);
diff --git a/src/main/java/com/dreamchaser/depository_manage/utils/LinkInterfaceUtil.java b/src/main/java/com/dreamchaser/depository_manage/utils/LinkInterfaceUtil.java
index 54fd3ed4..64921b6e 100644
--- a/src/main/java/com/dreamchaser/depository_manage/utils/LinkInterfaceUtil.java
+++ b/src/main/java/com/dreamchaser/depository_manage/utils/LinkInterfaceUtil.java
@@ -7,6 +7,7 @@ import com.dreamchaser.depository_manage.entity.Administration;
 import com.dreamchaser.depository_manage.entity.Post;
 import com.dreamchaser.depository_manage.entity.UserByPort;
 import com.dreamchaser.depository_manage.pojo.AdministrationP;
+import com.dreamchaser.depository_manage.security.pool.AuthenticationTokenPool;
 import org.apache.http.protocol.HTTP;
 
 import javax.servlet.http.HttpServletRequest;
@@ -168,7 +169,11 @@ public class LinkInterfaceUtil {
      * @return 结果
      */
     public static JSONObject Captcha(HttpServletRequest request) {
-        UserByPort userByPort = (UserByPort) request.getAttribute("userToken");
+        String token = request.getHeader("user-token");
+        if(token == null){
+            token = (String) request.getSession().getAttribute("userToken");
+        }
+        UserByPort userByPort = AuthenticationTokenPool.getUserToken(token);
         String url = PortConfig.external_url_6666 + "/base/captcha";
         JSONObject param = new JSONObject();
         String post = null;
diff --git a/src/main/resources/static/js/cookie.js b/src/main/resources/static/js/cookie.js
deleted file mode 100644
index 6b296f60..00000000
--- a/src/main/resources/static/js/cookie.js
+++ /dev/null
@@ -1,52 +0,0 @@
-var cookieUtil = {
-    createCookie: function (name, value, days) {
-        var expires = "";
-        if (days) {
-            var date = new Date();
-            date.setTime(date.getTime() + (days * 14 * 24 * 3600 * 1000));
-            expires = ";expires=" + date.toGMTString();
-        }
-        document.cookie = name + "=" + value + expires + ";path=/";
-    },
-    /*设置cookie*/
-    set: function (name, value, expires, path, domain, secure) {
-        var cookie = encodeURIComponent(name) + "=" + encodeURIComponent(value);
-        if (expires instanceof Date) {
-            cookie += "; expires=" + expires.toGMTString();
-        } else {
-            var date = new Date();
-            date.setTime(date.getTime() + expires * 24 * 3600 * 1000);
-            cookie += "; expires=" + date.toGMTString();
-        }
-        if (path) {
-            cookie += "; path=" + path;
-        }
-        if (domain) {
-            cookie += "; domain=" + domain;
-        }
-        if (secure) {
-            cookie += "; " + secure;
-        }
-        document.cookie = cookie;
-    },
-    /*获取cookie*/
-    get: function (name) {
-        var cookieName = encodeURIComponent(name);
-        /*正则表达式获取cookie*/
-        var restr = "(^| )" + cookieName + "=([^;]*)(;|$)";
-        var reg = new RegExp(restr);
-        var cookieValue = document.cookie.match(reg)[2];
-        /*字符串截取cookie*/
-        /*var cookieStart=document.cookie.indexOf(cookieName+“=”);
-        var cookieValue=null;
-        if(cookieStart>-1){
-            var cookieEnd=document.cookie.indexOf(";",cookieStart);
-            if(cookieEnd==-1){
-                cookieEnd=document.cookie.length;
-            }
-            cookieValue=decodeURIComponent(document.cookie.substring(cookieStart
-            +cookieName.length,cookieEnd));
-        }*/
-        return cookieValue;
-    }
-}
diff --git a/src/main/resources/static/js/lay-config.js b/src/main/resources/static/js/lay-config.js
index 269e8606..08639cf7 100644
--- a/src/main/resources/static/js/lay-config.js
+++ b/src/main/resources/static/js/lay-config.js
@@ -11,9 +11,9 @@ window.rootPath = (function (src) {
 })();
 let r = layui.config({
     base: rootPath + "lay-module/",
-    // base: "https://jy.hxgk.group/static/js/" + "lay-module/",
     version: true
 });
+
 r.extend({
     miniAdmin: "layuimini/miniAdmin", // layuimini后台扩展
     miniMenu: "layuimini/miniMenu", // layuimini菜单扩展
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 204f6ad5..c310294d 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -200,7 +200,10 @@
                 },
                 success: function (data) {
                     layer.close(this.layerIndex);
-                    layer.msg(data.statusInfo.message, function () {
+                    layer.msg(data.statusInfo.message,{
+                        icon:0,
+                        time:500
+                    }, function () {
                         window.location = '/login';
                     });
                 }
diff --git a/src/main/resources/templates/pages/user/login.html b/src/main/resources/templates/pages/user/login.html
index 86ecbd0f..66243ce8 100644
--- a/src/main/resources/templates/pages/user/login.html
+++ b/src/main/resources/templates/pages/user/login.html
@@ -69,7 +69,6 @@
 <script  src="static/lib/jquery-3.4.1/jquery-3.4.1.min.js" charset="utf-8"></script>
 <script  src="static/lib/layui-v2.6.3/layui.js" charset="utf-8"></script>
 <script  src="static/lib/jq-module/jquery.particleground.min.js" charset="utf-8"></script>
-<script  src="static/js/cookie.js" charset="utf-8"></script>
 <script>
 
     layui.use(['layer','form'], function () {
@@ -135,7 +134,6 @@
                             icon: 6,//成功的表情
                             time: 1000 //1秒关闭（如果不配置，默认是3秒）
                         }, function(){
-                            // cookieUtil.createCookie("token",data.data)
                             window.location = '/index';
                         });
 
diff --git a/target/classes/static/js/cookie.js b/target/classes/static/js/cookie.js
deleted file mode 100644
index 6b296f60..00000000
--- a/target/classes/static/js/cookie.js
+++ /dev/null
@@ -1,52 +0,0 @@
-var cookieUtil = {
-    createCookie: function (name, value, days) {
-        var expires = "";
-        if (days) {
-            var date = new Date();
-            date.setTime(date.getTime() + (days * 14 * 24 * 3600 * 1000));
-            expires = ";expires=" + date.toGMTString();
-        }
-        document.cookie = name + "=" + value + expires + ";path=/";
-    },
-    /*设置cookie*/
-    set: function (name, value, expires, path, domain, secure) {
-        var cookie = encodeURIComponent(name) + "=" + encodeURIComponent(value);
-        if (expires instanceof Date) {
-            cookie += "; expires=" + expires.toGMTString();
-        } else {
-            var date = new Date();
-            date.setTime(date.getTime() + expires * 24 * 3600 * 1000);
-            cookie += "; expires=" + date.toGMTString();
-        }
-        if (path) {
-            cookie += "; path=" + path;
-        }
-        if (domain) {
-            cookie += "; domain=" + domain;
-        }
-        if (secure) {
-            cookie += "; " + secure;
-        }
-        document.cookie = cookie;
-    },
-    /*获取cookie*/
-    get: function (name) {
-        var cookieName = encodeURIComponent(name);
-        /*正则表达式获取cookie*/
-        var restr = "(^| )" + cookieName + "=([^;]*)(;|$)";
-        var reg = new RegExp(restr);
-        var cookieValue = document.cookie.match(reg)[2];
-        /*字符串截取cookie*/
-        /*var cookieStart=document.cookie.indexOf(cookieName+“=”);
-        var cookieValue=null;
-        if(cookieStart>-1){
-            var cookieEnd=document.cookie.indexOf(";",cookieStart);
-            if(cookieEnd==-1){
-                cookieEnd=document.cookie.length;
-            }
-            cookieValue=decodeURIComponent(document.cookie.substring(cookieStart
-            +cookieName.length,cookieEnd));
-        }*/
-        return cookieValue;
-    }
-}
diff --git a/target/classes/static/js/lay-config.js b/target/classes/static/js/lay-config.js
index 269e8606..08639cf7 100644
--- a/target/classes/static/js/lay-config.js
+++ b/target/classes/static/js/lay-config.js
@@ -11,9 +11,9 @@ window.rootPath = (function (src) {
 })();
 let r = layui.config({
     base: rootPath + "lay-module/",
-    // base: "https://jy.hxgk.group/static/js/" + "lay-module/",
     version: true
 });
+
 r.extend({
     miniAdmin: "layuimini/miniAdmin", // layuimini后台扩展
     miniMenu: "layuimini/miniMenu", // layuimini菜单扩展
diff --git a/target/classes/templates/index.html b/target/classes/templates/index.html
index 204f6ad5..c310294d 100644
--- a/target/classes/templates/index.html
+++ b/target/classes/templates/index.html
@@ -200,7 +200,10 @@
                 },
                 success: function (data) {
                     layer.close(this.layerIndex);
-                    layer.msg(data.statusInfo.message, function () {
+                    layer.msg(data.statusInfo.message,{
+                        icon:0,
+                        time:500
+                    }, function () {
                         window.location = '/login';
                     });
                 }
diff --git a/target/classes/templates/pages/scanQrCode/ScanBarOrQrCodeOut.html b/target/classes/templates/pages/scanQrCode/ScanBarOrQrCodeOut.html
index 780bb161..dcb0c419 100644
--- a/target/classes/templates/pages/scanQrCode/ScanBarOrQrCodeOut.html
+++ b/target/classes/templates/pages/scanQrCode/ScanBarOrQrCodeOut.html
@@ -60,7 +60,7 @@
         }else{
             wxScan = wxScan.parent.wx;
         }
-        /*wxScan.scanQRCode({
+        wxScan.scanQRCode({
             desc: 'scanQRCode desc',
             needResult: 1, // 默认为0，扫描结果由企业微信处理，1则直接返回扫描结果，
             scanType: ["barCode", "qrCode"], // 可以指定扫二维码还是条形码（一维码），默认二者都有
@@ -79,12 +79,7 @@
 
             }
 
-        });*/
-        var result ="1614903417674964992";//当needResult为1时返回处理结果
-        var req = {};
-        req.qrCode = result;
-        outboundLogic(req);
-
+        });
     });
 
 
diff --git a/target/classes/templates/pages/user/login.html b/target/classes/templates/pages/user/login.html
index 86ecbd0f..66243ce8 100644
--- a/target/classes/templates/pages/user/login.html
+++ b/target/classes/templates/pages/user/login.html
@@ -69,7 +69,6 @@
 <script  src="static/lib/jquery-3.4.1/jquery-3.4.1.min.js" charset="utf-8"></script>
 <script  src="static/lib/layui-v2.6.3/layui.js" charset="utf-8"></script>
 <script  src="static/lib/jq-module/jquery.particleground.min.js" charset="utf-8"></script>
-<script  src="static/js/cookie.js" charset="utf-8"></script>
 <script>
 
     layui.use(['layer','form'], function () {
@@ -135,7 +134,6 @@
                             icon: 6,//成功的表情
                             time: 1000 //1秒关闭（如果不配置，默认是3秒）
                         }, function(){
-                            // cookieUtil.createCookie("token",data.data)
                             window.location = '/index';
                         });