Spring Security - 用户在会话销毁时保持身份验证

Question

I'm developing a website with Spring and I use Spring Security for authentication. I got a problem that I'm not able to fix:

<div sec:authorize="!isAuthenticated()" id="login">
    SHOW IF NOT AUTHENTICATED
</div>
<div sec:authorize="isAuthenticated()">
    Hi <span th:text="${session.user.email}"></span>
</div>

When session gets destroyed, for example by a change in WebSecurityConfigurerAdapter, the second div is displayed causing an internal server error since session.user object is null.

How can I make user "unauthenticated" when his session is destroyed?

EDIT: SecurityConfig

@Override
    protected void configure(HttpSecurity http) throws Exception {

        http.sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
        .sessionAuthenticationErrorUrl("/login?error")
        .maximumSessions(1)
        .maxSessionsPreventsLogin(false)
        .expiredUrl("/login?expired")
        .and()
        .sessionFixation().newSession();

        http.authorizeRequests()
        .antMatchers("/css/**", "/img/**", "/fonts/**", "/js/**", "/", "/home", "/prizes", "/login").permitAll()
        .anyRequest().authenticated()
        .and()
        .formLogin().loginPage("/login").loginProcessingUrl("/dologin")
        .usernameParameter("username").passwordParameter("password")
        .defaultSuccessUrl("/loginsuccessful").failureUrl("/login?invalid").permitAll()
        .and()
        .logout()
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/")
        .permitAll();
    }

Spring Security Log when calling /logout

************************************************************

Request received for GET '/logout':

org.apache.catalina.connector.RequestFacade@1512eefb

servletPath:/logout
pathInfo:null
headers: 
host: localhost:8080
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
accept-language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
accept-encoding: gzip, deflate
referer: http://localhost:8080/
cookie: JSESSIONID=0179284CCE4040DA16C9F16D9AB14AF2
dnt: 1
connection: keep-alive
upgrade-insecure-requests: 1


Security filter chain: [
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  CsrfFilter
  LogoutFilter
  UsernamePasswordAuthenticationFilter
  ConcurrentSessionFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]


************************************************************


2017-05-10 12:45:44.079  INFO 12028 --- [nio-8080-exec-2] Spring Security Debugger                 : 

************************************************************

Request received for GET '/':

org.apache.catalina.connector.RequestFacade@1512eefb

servletPath:/
pathInfo:null
headers: 
host: localhost:8080
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
accept-language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
accept-encoding: gzip, deflate
referer: http://localhost:8080/
cookie: JSESSIONID=0179284CCE4040DA16C9F16D9AB14AF2
dnt: 1
connection: keep-alive
upgrade-insecure-requests: 1


Security filter chain: [
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  CsrfFilter
  LogoutFilter
  UsernamePasswordAuthenticationFilter
  ConcurrentSessionFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]


************************************************************

Answer 1

好吧，我无法使用isAuthenticated（），所以我通过在preHandle（）方法（在拦截器）手动检查会话中的每个用户对象来修复它