java - 如何在 Spring 注销前执行操作？

Question

首先，这不是一个重复的问题，我检查了答案 here !和 here !但无法让它工作。

另外我想在注销之前执行它，所以不能使用 logoutSuccessHandler。

所以我需要创建一个自定义的 LOGOUT_FILTER ，我真的很难让它工作。

这是我的 spring-security xml，我在其中尝试了两种方法首先是:-

 <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />

<beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
<beans:constructor-arg index="0" value="/logoutSuccess" />
<beans:constructor-arg index="1">
    <beans:list>
        <beans:bean id="securityContextLogoutHandler"
        class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
    <beans:bean id="myLogoutHandler" class="com.fe.cms.listener.SimpleLogoutHandler" />
    </beans:list>
</beans:constructor-arg>
<beans:property name="filterProcessesUrl" value="/logout" />
</beans:bean>

但这给了我错误

Configuration problem: Security namespace does not support decoration of element [custom-filter] 

然后我试了..

<beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <beans:constructor-arg index="0" value="/logout" />
    <beans:constructor-arg index="1">
        <beans:ref bean="securityContextLogoutHandler" />
        <beans:ref bean="myLogoutHandler" />
    </beans:constructor-arg>
    <beans:property name="filterProcessesUrl" value="/logout" />
</beans:bean>

<beans:bean id="securityContextLogoutHandler"
    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />

<beans:bean id="myLogoutHandler" class="com.fe.cms.listener.SimpleLogoutHandler" />

<http auto-config="false" entry-point-ref="authenticationManger">
    <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />
</http>

但这给了我错误:-

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#48' while setting bean property 'sourceList' with key [48]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#48': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.ExceptionTranslationFilter] while setting constructor argument with key [6]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#181': Could not resolve matching constructor (hint: specify index/type/name arguments for simple parameters to avoid type ambiguities)

谁能告诉我我哪里做错了..如果需要，我会发布完整的 xml 文件

Answer 1

根据您的说明，您想要访问 session 并执行一些逻辑。与其使用自定义的 LogoutFilter 进行修改，不如简单地编写一个 ApplicationListener 来监听 HttpSessionDestroyedEvent秒。

@Component
public class SessionListener implements ApplicationListener<HttpSessionDestroyedEvent> {

    public void onApplicationEvent(HttpSessionDestroyedEvent evt) {
        HttpSession session = evt.getSession();
        // Your logic here
    }
}

为了能够重新接收事件，请确保您注册了 HttpSessionEventPublisher在你的 web.xml 中。

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>

此解决方案的主要优点是您还可以处理超时 session ，而不仅仅是常规注销。