Spring Security WebFlux 注销

Question

类似于注销时，使会话无效并删除 WebFlux 中的 cookie 的等效方法是什么

public class SecurityConfig extends WebSecurityConfigurerAdapter {



    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http
        .httpBasic()
        .and()
        .logout().clearAuthentication(true)
        .logoutSuccessUrl("/")
        .deleteCookies("JSESSIONID")
        .invalidateHttpSession(true)
        .and()
...

Answer 1

除了默认删除 cookie“SESSION”和 WebSession（WebFlux 中的会话名称）之外，您还可以配置 ServerLogoutSuccessHandler：

    .logout()
        .logoutSuccessHandler(new ServerLogoutSuccessHandler() {
            @Override
            public Mono<Void> onLogoutSuccess(WebFilterExchange exchange, Authentication authentication) {
                ServerHttpResponse response = exchange.getExchange().getResponse();
                response.setStatusCode(HttpStatus.FOUND);
                response.getHeaders().setLocation(URI.create("/login.html?logout"));
                response.getCookies().remove("JSESSIONID");
                return exchange.getExchange().getSession()
                    .flatMap(WebSession::invalidate);
            }
        })