java - 如何在 Spring Boot WebFlux 中使用 GET 请求注销

Question

如何配置 securityWebFilterChain(ServerHttpSecurity http) 以便我的应用程序在 GET/logout 上注销？

我有 SpringBoot 2 Spring 5 和 WebFlux

我尝试过:

  http
    .logout()
      .requiresLogout(ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/logout"))
      .logoutSuccessHandler(logoutSuccessHandler("/after-life"))

问题是，LogoutPageGenerateWebFilter 位于发出的 SecurityWebFilterChain 中的 LogoutWebFilter 之前。其中有一个硬编码的 .pathMatchers(HttpMethod.GET, "/logout") - 这导致我的应用程序始终在 GET 请求上发出 html 页面。

我发现没有办法抑制自动注销页面的生成:(

Answer 1

正如文档中所述，

The default is that Spring Security will generate a log in page at "/login" and a log out page at "/logout". If this is customized: The default log in & log out page are no longer provided The application must render a log in page at the provided URL The application must render an authentication error page at the provided URL + "?error" Authentication will occur for POST to the provided URL

自定义配置以默认登录且不默认注销。

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity httpSecurity){

        LoginPageGeneratingWebFilter loginpage= new LoginPageGeneratingWebFilter();
        loginpage.setFormLoginEnabled(true);
        return httpSecurity
                .addFilterAt(loginpage, SecurityWebFiltersOrder.LOGIN_PAGE_GENERATING)
                .authorizeExchange()
                    .pathMatchers("/home").authenticated()
                        .and().formLogin()                      
                            .loginPage("/login")                         
                        .and()
                        .logout()
                        .logoutUrl("/logout").requiresLogout(ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/logout"))
                        .and()

                .build();

    }