Spring Security:如何以编程方式清除`remember me` cookie？

Question

我在下面的web-app中使用logout方法,但是如果我检查remember me注销不起作用,因为cookie没有被清除.如何在我的方法中以编程方式清除此cookie(或如何更好地注销方法)？

public void logout() {
    AnonymousAuthenticationToken anonymous = new AnonymousAuthenticationToken("anonymous", "anonymous", new ArrayList(Arrays.asList(new GrantedAuthorityImpl("ROLE_ANONYMOUS"))));
    SecurityContextHolder.getContext().setAuthentication(anonymous);
}

Answer 1

如果您使用标准的Spring Security cookie名称(即SPRING_SECURITY_REMEMBER_ME_COOKIE),则可以执行以下操作:

void cancelCookie(HttpServletRequest request, HttpServletResponse response)
{
  String cookieName = "SPRING_SECURITY_REMEMBER_ME_COOKIE";
  Cookie cookie = new Cookie(cookieName, null);
  cookie.setMaxAge(0);
  cookie.setPath(StringUtils.hasLength(request.getContextPath()) ? request.getContextPath() : "/");
  response.addCookie(cookie);
}

cookieName如果您使用自定义cookie名称,则必须更改该值.