Spring 引导：注销后，带有过期 Cookie 的请求仍然可用

Question

In the spring boot project, when the user logouts, we invalidate the cookie with this block of code:

//name = "Token"
//value = "expired"
//age = 0
private void setExpiredCookie(HttpServletResponse response, String name, String value, int age) {
    Cookie cookie = new Cookie(name, value);
        cookie.setSecure(true); //Send cookie to the server only over an encrypted HTTPS connection
        cookie.setHttpOnly(true); //Preventing cross-site scripting attacks
        cookie.setPath("/"); //Global cookie accessible every where
        cookie.setMaxAge(age); //Deleting a cookie. I Passed the same other cookie properties when you used to set it

        response.addCookie(cookie);
}

However, after logout, I tested my website with an application for catching the request and resending it through the repeater, with exact values, such as token and payload.

I resent a request, for example, to change the email address, and this request, despite logging out , is valid for 15 minutes (for the life of the original cookie).

What am I missing? Because I am properly deleting and protecting cookies.

Answer 1

You are just creating new cookie. You should invalidate cookie with session id, which was given to you when you authenticated. Simply use this:

HttpSession session = httpServletRequest.getSession(false);
session.invalidate();