如何从 Spring Security 中注销当前用户？

Question

I have a simple Springboot server using Spring Security and I am having trouble logging the user out.

Expected outcome: I expected to be able to hit the endpoint /logout in my browser's URL and then I would be asked to log in again.

Actual outcome: I hit the /logout endpoint, and the user is still logged in. I can still see all routes that should be hidden to users that are not logged in.

This is my SpringConfiguration.java file:

@Configuration
@EnableConfigurationProperties
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    MongoUserDetailsService userDetailsService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/", "/register").permitAll().anyRequest().authenticated()
                .and().httpBasic()
                .and().sessionManagement().disable();

        http.logout().clearAuthentication(true).logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/logout.done").invalidateHttpSession(true);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    public void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(userDetailsService);
    }

After I naviagte to /logout in my browser, the url changes to logout.done but I can still see pages that I should not have access to.

---

I have also tried this with the same results:

   @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/", "/register").permitAll().anyRequest().authenticated()
                .and().httpBasic()
                .and().sessionManagement().disable().logout()
                .logoutSuccessHandler(new CustomLogoutSuccessHandler())
                .invalidateHttpSession(true)
                .and().csrf().disable();
    }

And the CustomLogoutSuccessHandler.java looks like this:

public class CustomLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {
        Cookie cookie = new Cookie("JSESSIONID", null);
        cookie.setPath(request.getContextPath());
        cookie.setMaxAge(0);
        response.addCookie(cookie);

        if (request.getParameter("expired") != null) {
            response.sendRedirect(request.getContextPath() + "/login?expired=true");
        } else {
            response.sendRedirect(request.getContextPath() + "/login?logout=true");
        }
    }
}

---

I also tried this configuration, and still, the same result...

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/", "/register").permitAll().anyRequest().authenticated()
                .and().httpBasic()
                .and().sessionManagement().disable();

        http.csrf().disable()
                .logout(logout -> logout
                        .clearAuthentication(true)
                        .logoutUrl("/logout")
                        .logoutSuccessUrl("/")
                        .invalidateHttpSession(true)
                        .deleteCookies("JSESSIONID"));
    }

---

Trying what Ajay mentioned has also failed me. My config now looks like this:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/", "/register").permitAll().anyRequest().authenticated()
                .and().httpBasic()
                .and().sessionManagement().disable();

        // TODO : LOGOUT IS NOT WORKING
        http.csrf().disable()
                .logout(logout -> logout
                        .permitAll()
                        .clearAuthentication(true)
                        .logoutUrl("/logout")
                        .logoutSuccessUrl("/")
                        .invalidateHttpSession(true)
                        .deleteCookies("JSESSIONID"));
    }

Controller:

    public String logoutPage(HttpServletRequest request, HttpServletResponse response) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null) {
            new SecurityContextLogoutHandler().logout(request, response, auth);
            SecurityContextHolder.getContext().setAuthentication(null);
            logger.info("logged out");
        }
        return "redirect:login?logout";
    }

Answer 1

Not sure what you have on logout.done page. But this is how I would logout.

Suggestion: Your logoutSuccessUrl should be either your home page or you might want to redirect user back to login page.

Controller : To nullify the authentication and to redirect to some page (say - login page).

@RequestMapping(value = "logout", method = RequestMethod.GET)
        public String logoutPage(HttpServletRequest request, HttpServletResponse response) {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            if (auth != null) {
                new SecurityContextLogoutHandler().logout(request, response, auth);
                SecurityContextHolder.getContext().setAuthentication(null);
            }
            return "redirect:login?logout";
    }

My Config :

(...).formLogin().loginPage("/login").permitAll().and().logout().permitAll().and().(...)

And View (say jsp) :

<a href="${contextPath}/logout">Logout</a>

Not just this, there are other (similar) ways to do it too. Also you will find numerous example over the web and lots of SO threads too for the similar situation. I would recommend take a look what different approaches people are following to achieve this.