注销在Spring Boot应用程序中不起作用（不支持POST方法）

Question

I have a Spring Boot application with the following configuration

@Configuration
@EnableWebSecurity
open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
    override fun configure(http:HttpSecurity) {
        http
            .authorizeRequests()
                .antMatchers("/css/**", "/js/**", "/fonts/**")
                .permitAll().and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .logout() 
                .logoutSuccessUrl("/login") 
                .permitAll()
            .and().csrf().disable()
    }
    @Autowired
    fun configureGlobal(auth:AuthenticationManagerBuilder) {
        auth
            .inMemoryAuthentication()
                .withUser("usr@provider.com").password("test").roles("USER")
    }
}

When I try to log out, I get the error

There was an unexpected error (type=Method Not Allowed, status=405). Request method 'POST' not supported

How can I fix it?

How to reproduce

1. Check out the code from this repository .
2. gradle bootRun
3. Go to http://localhost:8080 , enter usr@provider.com and test as user name and password, respectively.
4. Press the logout button.

Update 1: This doesn't work, either.

http
    .authorizeRequests()
        .antMatchers("/css/**", "/js/**", "/fonts/**", "/logout‌​")
        .permitAll().and()
    .formLogin()
        .loginPage("/login")
        .permitAll()
        .and()
    .authorizeRequests()
        .anyRequest().authenticated()
        .and()
    .csrf().disable()

Answer 1

I'm not familiar with Thymeleaf, but at least this will give you some idea.

The problem is not your SecurityConfig but the

th:action="@{/logout}"

(not redirect to /logout, check Network tab in Chrome or Firefox).

If I replace it with

action="/logout"

Then it work perfectly.

Answer 2

Have you tried specifying the logout path?

.logout() 
    .logoutSuccessUrl("/login")
    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
    .permitAll()

Answer 3

You can add "/logout" to the first section of allowed paths.

But why do you use a with a for the logout at all? You can use a simple link () that will issue a GET request.