如何在春季退出前進行操作？

Question

首先，這不是一個重復的問題，我在這里檢查答案！ 在這里 ！ 但無法讓它發揮作用。

我也想在注銷之前執行它，所以不能使用logoutSuccessHandler。

所以我需要創建一個自定義LOGOUT_FILTER，我真的很難讓它工作。

這是我的spring-security xml，其中我首先嘗試了兩種方法： -

 <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />

<beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
<beans:constructor-arg index="0" value="/logoutSuccess" />
<beans:constructor-arg index="1">
    <beans:list>
        <beans:bean id="securityContextLogoutHandler"
        class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
    <beans:bean id="myLogoutHandler" class="com.fe.cms.listener.SimpleLogoutHandler" />
    </beans:list>
</beans:constructor-arg>
<beans:property name="filterProcessesUrl" value="/logout" />
</beans:bean>

但這給了我錯誤

Configuration problem: Security namespace does not support decoration of element [custom-filter] 

然后我試過..

<beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <beans:constructor-arg index="0" value="/logout" />
    <beans:constructor-arg index="1">
        <beans:ref bean="securityContextLogoutHandler" />
        <beans:ref bean="myLogoutHandler" />
    </beans:constructor-arg>
    <beans:property name="filterProcessesUrl" value="/logout" />
</beans:bean>

<beans:bean id="securityContextLogoutHandler"
    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />

<beans:bean id="myLogoutHandler" class="com.fe.cms.listener.SimpleLogoutHandler" />

<http auto-config="false" entry-point-ref="authenticationManger">
    <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />
</http>

但這給了我錯誤： -

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#48' while setting bean property 'sourceList' with key [48]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#48': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.ExceptionTranslationFilter] while setting constructor argument with key [6]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#181': Could not resolve matching constructor (hint: specify index/type/name arguments for simple parameters to avoid type ambiguities)

請任何人都可以告訴我在哪里做錯了...如果需要，我會發布完整的xml文件

Answer 1

如果你需要在注銷之前執行一些操作，我想Spring 攔截器可以幫助你。

你可以實現這樣的類：

public class JustBeforeLogoutInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request,
            HttpServletResponse response, Object handler) throws Exception {
        boolean res = super.preHandle(request, response, handler);
        //
        // your code...
        //
        return res;
    }
}

然后你需要配置攔截器：

<mvc:interceptors>
    <mvc:interceptor>
        <mvc:mapping path="/logout" />
        <bean class="your.app.JustBeforeLogoutInterceptor" />
    </mvc:interceptor>
</mvc:interceptors>

這應該工作。 試一試。

Answer 2

根據您的澄清，您想要的是訪問會話並執行一些邏輯。 而不是使用自定義LogoutFilter進行攻擊，只需編寫一個偵聽HttpSessionDestroyedEvent的ApplicationListener 。

@Component
public class SessionListener implements ApplicationListener<HttpSessionDestroyedEvent> {

    public void onApplicationEvent(HttpSessionDestroyedEvent evt) {
        HttpSession session = evt.getSession();
        // Your logic here
    }
}

為了能夠重新接收事件，請確保在web.xml中注冊HttpSessionEventPublisher 。

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>

此解決方案的主要優點是您還可以處理超時的會話，而不僅僅是定期注銷。

Answer 3

在調用超類'doFilter方法之前，您可以嘗試擴展當前的LogoutFilter並執行自定義邏輯。

像這樣

public class CustomLogoutFilter extends LogoutFilter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        if (requiresLogout(request, response)) {
           // IMPLEMENT YOUR CUSTOM LOGIC HERE

            super.doFilter(req, res, chain);

            return;
        }

        chain.doFilter(request, response);
    }

}

然后，您必須使用CustomLogoutFilter替換默認的LogoutFilter

<http>
    <custom-filter position="LOGOUT_FILTER" ref="customLogoutFilter" />
</http>

<bean id="customLogutFilter" class="example.CustomLogoutFilter">
    <property name="filterProcessesUrl" value="/logout" />
    <!-- Put other needed properties here-->
</bean>