spring security自定义注销处理程序

Question

如何在spring-security中将自己的注销处理程序添加到LogoutFilter？谢谢!

Answer 1

以下解决方案适用于我,可能会有所帮助:

1. 扩展SimpleUrlLogoutSuccessHandler或实现LogoutHandler:

   public class LogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
   
      // Just for setting the default target URL
      public LogoutSuccessHandler(String defaultTargetURL) {
           this.setDefaultTargetUrl(defaultTargetURL);
      }
   
      @Override
      public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
   
           // do whatever you want
           super.onLogoutSuccess(request, response, authentication);
      }
   }
   

2. 添加到Spring安全配置:

   <security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler" />
   <bean id="logoutSuccessHandler" class="your.package.name.LogoutSuccessHandler" >
       <constructor-arg value="/putInYourDefaultTargetURLhere" />
   </bean>
   

Answer 2

您应该使用元素success-handler-ref的属性<logout>：

<security:logout invalidate-session="true"
          success-handler-ref="myLogoutHandler"
          logout-url="/logout" />

作为替代解决方案，您可以在注销 URL 上配置您自己的过滤器。