Spring Security注销未成功-处理程序-ref

Question

<http auto-config="false" entry-point-ref="customAuthenticationEntryPoint"  create-session="ifRequired" >
        <intercept-url pattern="/**" access="hasAuthority('Admin')" />
        <custom-filter before="BASIC_AUTH_FILTER"  ref="loginTokenFilter" />
        <logout logout-url="/logout" success-handler-ref="logoutSuccessHandler" />
        <access-denied-handler error-page="/noaccess.html"/>
        <headers>
            <frame-options policy="SAMEORIGIN" />
        </headers>
    </http>

@Component("logoutSuccessHandler")
    public class MyLogoutSuccessHandler implements LogoutSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(MyLogoutSuccessHandler.class);

    private final MyRedirectHandler redirectHandler;

    @Autowired
    public MyLogoutSuccessHandler(
            MyRedirectHandler redirectHandler) {
        this.redirectHandler = redirectHandler;
    }


    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        if (response.isCommitted()) {
            logger.debug("Won't redirect");
            return;
        }

        redirectHandler.redirectToLogin(request, response, true);
    }
}

在web.xml中，我有以下内容

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

Answer 1

默认情况下，Spring security启用CSRF，注销必须是POST请求，因为它需要CSRF令牌。查看Spring CSRF文档。另一个类似的SO问题

如果您希望注销以处理GET请求，可以在配置中像这样切换CSRF。

<http auto-config="false">
        <csrf disabled="true"/> 

如果您不想切换CSRF，您必须像这样发布注销

<c:url var="logoutUrl" value="/logout"/>
<form action="${logoutUrl}" method="post">
  <input type="submit" value="Log out" />
  <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>