Can you show me more details about userService’s login function?

Also if you use spring security, check SpringSecurity config.

//ex
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/login").permitAll()  
        .anyRequest().authenticated();   
}