java - 注销重定向 Spring Security

Question

我为我的 @Override 使用以下 Spring 安全配置

protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .authorizeRequests()
            .antMatchers("/login").permitAll()
        .and()
        .authorizeRequests()
            .antMatchers("/signup").permitAll()
        .and()
        .authorizeRequests()
            .anyRequest().authenticated()
        .and()
            .logout().logoutUrl("/logout").logoutSuccessUrl("/login").deleteCookies("auth_code").invalidateHttpSession(true)
        .and()
        // We filter the api/signup requests
        .addFilterBefore(
            new JWTSignupFilter("/signup", authenticationManager(),
                    accountRepository, passwordEncoder),
            UsernamePasswordAuthenticationFilter.class)
        // We filter the api/login requests
        .addFilterBefore(
            new JWTLoginFilter("/login", authenticationManager()),
            UsernamePasswordAuthenticationFilter.class)
        // And filter other requests to check the presence of JWT in
        // header
        .addFilterBefore(new JWTAuthenticationFilter(userDetailsServiceBean()),
            UsernamePasswordAuthenticationFilter.class);
}

我希望浏览器在成功注销后重定向到 /login URL。但我得到了这样的回应:

{
  "timestamp": 1493871686489,
  "status": 404,
  "error": "Not Found",
  "message": "No message available",
  "path": "/login"
}

编辑 1

我有一个登录过滤器，它捕获对 /login 端点的 POST 请求:

public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter {


    public JWTLoginFilter(String url, AuthenticationManager authManager) {
        super(new AntPathRequestMatcher(url, "POST"));
        setAuthenticationManager(authManager);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest req,
            HttpServletResponse res) throws AuthenticationException,
            IOException, ServletException {

        CustomUserDetails creds = new ObjectMapper().readValue(
                req.getInputStream(), CustomUserDetails.class);

        return getAuthenticationManager().authenticate(
                new UsernamePasswordAuthenticationToken(creds.getUsername(),
                        creds.getPassword()));
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest req,
            HttpServletResponse res, FilterChain chain, Authentication auth) {
        TokenAuthenticationService.addAuthentication(res, auth.getName());
    }
}

编辑2

以下休息 Controller 不会被击中!

@RestController
public class UserAcccountController {
    @Autowired
    AccountRepository accountRepository;

    @RequestMapping(path = "/login", method = RequestMethod.GET)
    public String loginGet() {
        return "/login";
    }

    @RequestMapping(path = "/login", method = RequestMethod.POST)
    public void loginPost(HttpServletResponse httpServletResponse) {
        httpServletResponse.setHeader("Location", "/home");
    }

}

Answer 1

解决方案是添加我在编辑 2 中包含的 Controller ，并且我还必须将登录过滤器中的 successfulAuthentication 编辑为以下内容:

@Override
protected void successfulAuthentication(HttpServletRequest req,
        HttpServletResponse res, FilterChain chain, Authentication auth) {
    TokenAuthenticationService.addAuthentication(res, auth.getName());
    chain.doFilter(req, res);
}