session获取不到登录用户

package com.liu.mall.filter;

import com.liu.mall.common.Constant;
import com.liu.mall.model.pojo.User;
import org.springframework.context.annotation.Configuration;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;
import java.io.IOException;
import java.io.PrintWriter;

public class UserFilter implements Filter {
    //过滤器拦截到登录的信息并进行保存，以后就可以从过滤器中提取用户
    public static User loginUser;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
       //防止乱码
        servletResponse.setContentType("text/html;charset=utf-8");
        servletResponse.setCharacterEncoding("utf-8");

        //得到登录的用户
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        loginUser = (User) request.getSession().getAttribute(Constant.USER);
        //校验
        if (loginUser == null) {
            //HttpServletResponseWrapper是对HttpServletResponse的包装。可以在请求响应前对拦截响应，进行处理等。
            //所以HttpServletResponseWrapper更加适合配合过滤器使用
            PrintWriter out = new HttpServletResponseWrapper(((HttpServletResponse) servletResponse)).getWriter();
            out.write("{    \"status\": 10007,    \"msg\": \"您还没有登录!\",    \"data\": null}");
            out.flush();
            out.close();
            return;
        }
        filterChain.doFilter(servletRequest, servletResponse);
    }

    @Override
    public void destroy() {

    }
}

package com.liu.mall.config;

import com.liu.mall.filter.UserFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

//配置校验用户的过滤器
@Configuration
public class UserFilterConfig {

    /**
     * 配置过滤器的两部：
     * 1.定义这个过滤器
     * 2.配置过滤器
     * @return
     */
        @Bean
        public UserFilter userFilter() {
            return new UserFilter();
        }

        @Bean(name = "userFilterConf")//这个名字，不要和类名相同，不然bean就分不清了
        public FilterRegistrationBean adminFilterConfig() {
            FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
            //添加过滤器
            filterRegistrationBean.setFilter(userFilter());
            //设置过滤path
            filterRegistrationBean.addUrlPatterns("/user/*");
            filterRegistrationBean.addUrlPatterns("/cart/*");
            filterRegistrationBean.addUrlPatterns("/order/*");
//            设置名字
            filterRegistrationBean.setName("userFilterConf");
            return filterRegistrationBean;
    }
}

/**
 * 登录
 */
@PostMapping("/login")
@ResponseBody
public ApiResponse login(String userName, String password, HttpSession session) throws MallException {
    //验证为空
    if (StringUtils.isEmpty(userName) || StringUtils.isEmpty(password)) {
        return ApiResponse.error(ExceptionEum.NAME_PASSWORD_NOT_NULL);
    }
    User user = userService.login(userName, password);
    user.setPassword(null);
    session.setAttribute(Constant.USER, user);
    return ApiResponse.success(user);
}

过滤器中通过session得不到用户