Spring Security的退出请求(默认为 /logout
)由 LogoutFilter
过滤器拦截处理。
<a href="/signOut">退出</a> 复制代码
...... .and() .logout() .logoutUrl("/signOut")//自定义退出的地址 .logoutSuccessUrl("/register")//退出之后跳转到注册页面 .deleteCookies("JSESSIONID")//删除当前的JSESSIONID .and() ...... 复制代码
效果如下
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; //#1.匹配到/logout请求 if (requiresLogout(request, response)) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (logger.isDebugEnabled()) { logger.debug("Logging out user '" + auth + "' and transferring to logout destination"); } //#2.处理1-4步 this.handler.logout(request, response, auth); //#3.重定向到注册界面 logoutSuccessHandler.onLogoutSuccess(request, response, auth); return; } chain.doFilter(request, response); } 复制代码
CookieClearingLogoutHandler
清空Cookie PersistentTokenBasedRememberMeServices
清空 remember-me
SecurityContextLogoutHandler
使当前 session
无效,清空当前的 SecurityContext
Cookie置为null
public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { for (String cookieName : cookiesToClear) { //# 1.Cookie置为null Cookie cookie = new Cookie(cookieName, null); String cookiePath = request.getContextPath(); if (!StringUtils.hasLength(cookiePath)) { cookiePath = "/"; } cookie.setPath(cookiePath); cookie.setMaxAge(0); response.addCookie(cookie); } } 复制代码
清空persistent_logins表中记录
public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { super.logout(request, response, authentication); if (authentication != null) { //#1.清空persistent_logins表中记录 tokenRepository.removeUserTokens(authentication.getName()); } } 复制代码
public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { Assert.notNull(request, "HttpServletRequest required"); if (invalidateHttpSession) { HttpSession session = request.getSession(false); if (session != null) { logger.debug("Invalidating session: " + session.getId()); //#1.使当前session失效 session.invalidate(); } } if (clearAuthentication) { SecurityContext context = SecurityContextHolder.getContext(); //#2.清空当前的`SecurityContext` context.setAuthentication(null); } SecurityContextHolder.clearContext(); } 复制代码
protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { //#1.获取配置的跳转地址 String targetUrl = determineTargetUrl(request, response); if (response.isCommitted()) { logger.debug("Response has already been committed. Unable to redirect to " + targetUrl); return; } //#2.跳转请求 redirectStrategy.sendRedirect(request, response, targetUrl); } 复制代码