java - Spring Security 在尝试注销时返回 302

Question

我使用 Spring security (4.0.2.RELEASE) 来保护我的应用程序。

我可以正常登录并且我经过身份验证的 URL 受到保护，但是当我尝试注销时，我不断收到 302 POST 响应，然后重定向到我配置的 failureUrl(“/cms/login?error”)。

这是我的 WebSecurityConfig 类

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
   @Override
   protected void configure(HttpSecurity http) throws Exception
   {        
       http        
       .authorizeRequests()
           .antMatchers("/*").permitAll()
           .antMatchers("/cms/*").authenticated()
           .antMatchers("/cms/*/*").authenticated()
           .antMatchers("/cms/*/*/*").authenticated().and()
       .formLogin()
           .loginPage("/cms/login")
           .defaultSuccessUrl("/cms/login?success")
           .failureUrl("/cms/login?error")
           .permitAll().and()
       .logout()
           .logoutUrl("/cms/login?logout")
           .logoutSuccessUrl("/cms/login")
           .permitAll();
   }

   @Autowired
   public void configureGlobal(AuthenticationManagerBuilder auth)      throws Exception
   {
       auth.inMemoryAuthentication()
           .withUser("u")
           .password("p")
           .roles("USER");
   }

   @Bean
   public PasswordEncoder passwordEncoder()
   {
       return new BCryptPasswordEncoder();
   }
  }

这是我的登录 Controller :

@Slf4j
@Controller
@RequestMapping(value = {"/cms", "/cms/login"})
public class CmsLoginController extends CmsBaseController
{   
    @RequestMapping
    public ModelAndView handleLogin(HttpServletResponse request,
                                    Model model,
                                    @RequestParam(value = LOGIN_SUCCESS, required = false) String success,
                                    @RequestParam(value = LOGIN_ERROR, required = false) String error,
                                    @RequestParam(value = LOGOUT, required = false) String logout)
    {   
        try
        {       
            if (success != null)
            {               
                setLoggedIn(true);
                request.sendRedirect(XXXXX);
            }

            if (error != null)
            {
                model.addAttribute(LOGIN_ERROR, "Invalid username and password!");
            }

            if (logout != null)
            {
                model.addAttribute(LOGOUT, "You've been logged out successfully.");
                setLoggedIn(false);
            }

            return new ModelAndView(CMS_CONTEXT + LOGIN_URL);
        }
        catch(Exception e)
        {
            setLoggedIn(false);
            log.error(e.toString(), e);

            return new ModelAndView(ERROR_VIEW_NAME);
        }   
    }
}    

郑重声明，我最初的注销功能运行良好，但不幸的是我一定引入了一些破坏它的更改......

有什么想法吗？谢谢

Answer 1

spring 为重定向完成的不必要的注销逻辑有点困扰我。

默认行为应该是直接的而不是重定向，并且他们可以为特殊情况保留条款。

在配置方法中使用以下内容

.logout().logoutUrl("/api/logout")
            .logoutSuccessHandler(new LogoutSuccessHandler() {

                @Override
                public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
                        Authentication authentication) throws IOException, ServletException {
                    System.out.println("success");
                }
            });

感谢此链接 https://www.codeproject.com/Tips/521847/Logout-Spring-s-LogoutFilter