Question

I am new to Spring Web MVC..

Can I get some example or online link that shows me how to implement logout feature using spring web mvc ?

I don t want to use the in built feature of spring security (i.e. ACEGI)..

Thanks in advance...

Answer 1

The trick with the session invalidation doesn t work. It seems the Spring authentication buffers the session ID somewhere and accept the COOKIE even, if the session was invalidated.

Another solution is to clear the Spring security context manually:

public void manualLogout() {
    SecurityContextHolder.getContext().setAuthentication(null);
}

Here is the code, how to log in user manually (if somebody needs):

public void doManualLogin(HttpServletRequest request, String u, String p) {
    UsernamePasswordAuthenticationToken token = 
            new UsernamePasswordAuthenticationToken(u, p);
    token.setDetails(new WebAuthenticationDetails(request));
    Authentication auth = authenticationProvider.authenticate(token);
    SecurityContextHolder.getContext().setAuthentication(auth);
}

where the authenticationProvider is the bean from you spring configuration which implements

org.springframework.security.authentication.AuthenticationProvider

Answer 2

You only have to invalidate the session and the user is logged out. This is directly supported by the servlet api: HttpSession.invalidate(). You can write one controller that does only call invalidate.

class Logout implements Controller{
 public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response){
   ModelAndView view = //?;
   request.getSession().invalidate();
   return view;
 }      
}

Answer 3

@Controller
    public class LogoutController {

        @RequestMapping(value="/logout",method = RequestMethod.GET)
        public String logout(HttpServletRequest request){
            HttpSession httpSession = request.getSession();
            httpSession.invalidate();
            return "redirect:/";
        }

    }

Please use above code to implement logout filter

友情链接