iSharkFly-Docs
/
java-tutorials
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bael 3970 (#9236) 

* Manual logout with Spring Security
- Basic manual logout
- logout with Clear Data Site Header

* Add missing annotation for controller. Change mapping URL value.

* Add intergration tests for manual logouts.

* BAEL-3970 - Add asserts on test. Fix tests names. Remove unused imports.

* BAEL-3970 - Use PostMapping annotation. Remove unnecessary information for security configuration.

* remove logout controllers

* Add multiple entrypoints configurations. Create custom handlers for different logouts (basic, cookie clearing, clear-site-data).

* Refactor configuration with lambda DSL.

* BAEL-3970 - Remove unnecessary handler for basic logout. Fix integration tests for basic logout.
This commit is contained in:
SippingCode 2020-05-05 00:08:00 +02:00 committed by GitHub
parent aee002eeca
commit 2d7bc17dda
2 changed files with 29 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
spring-5-security/src/main/java/com/baeldung/manuallogout/SimpleSecurityConfiguration.java
View File

@ -2,14 +2,12 @@ package com.baeldung.manuallogout;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order; import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler;
import org.springframework.security.web.authentication.logout.HeaderWriterLogoutHandler; import org.springframework.security.web.authentication.logout.HeaderWriterLogoutHandler;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler; import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter; import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter;
import javax.servlet.http.Cookie; import javax.servlet.http.Cookie;
@ -26,13 +24,11 @@ public class SimpleSecurityConfiguration {
@Override @Override
protected void configure(HttpSecurity http) throws Exception { protected void configure(HttpSecurity http) throws Exception {
http http
.antMatcher("/basic/**") .antMatcher("/basic/**")
.authorizeRequests(authz -> authz.anyRequest().permitAll()) .authorizeRequests(authz -> authz.anyRequest().permitAll())
.logout(logout -> logout .logout(logout -> logout
.logoutUrl("/basic/basiclogout") .logoutUrl("/basic/basiclogout")
.addLogoutHandler(new SecurityContextLogoutHandler()) );
.addLogoutHandler(new CookieClearingLogoutHandler(AbstractRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY))
);
} }
} }
@ -42,20 +38,20 @@ public class SimpleSecurityConfiguration {
@Override @Override
protected void configure(HttpSecurity http) throws Exception { protected void configure(HttpSecurity http) throws Exception {
http http
.antMatcher("/cookies/**") .antMatcher("/cookies/**")
.authorizeRequests(authz -> authz.anyRequest().permitAll()) .authorizeRequests(authz -> authz.anyRequest().permitAll())
.logout(logout -> logout .logout(logout -> logout
.logoutUrl("/cookies/cookielogout") .logoutUrl("/cookies/cookielogout")
.addLogoutHandler(new SecurityContextLogoutHandler()) .addLogoutHandler(new SecurityContextLogoutHandler())
.addLogoutHandler((request, response, auth) -> { .addLogoutHandler((request, response, auth) -> {
for (Cookie cookie : request.getCookies()) { for (Cookie cookie : request.getCookies()) {
String cookieName = cookie.getName(); String cookieName = cookie.getName();
Cookie cookieToDelete = new Cookie(cookieName, null); Cookie cookieToDelete = new Cookie(cookieName, null);
cookieToDelete.setMaxAge(0); cookieToDelete.setMaxAge(0);
response.addCookie(cookieToDelete); response.addCookie(cookieToDelete);
} }
} })
)); );
} }
} }
@ -64,17 +60,17 @@ public class SimpleSecurityConfiguration {
public static class ClearSiteDataHeaderLogoutConfiguration extends WebSecurityConfigurerAdapter { public static class ClearSiteDataHeaderLogoutConfiguration extends WebSecurityConfigurerAdapter {
private static final ClearSiteDataHeaderWriter.Directive[] SOURCE = private static final ClearSiteDataHeaderWriter.Directive[] SOURCE =
{ CACHE, COOKIES, STORAGE, EXECUTION_CONTEXTS }; {CACHE, COOKIES, STORAGE, EXECUTION_CONTEXTS};
@Override @Override
protected void configure(HttpSecurity http) throws Exception { protected void configure(HttpSecurity http) throws Exception {
http http
.antMatcher("/csd/**") .antMatcher("/csd/**")
.authorizeRequests(authz -> authz.anyRequest().permitAll()) .authorizeRequests(authz -> authz.anyRequest().permitAll())
.logout(logout -> logout .logout(logout -> logout
.logoutUrl("/csd/csdlogout") .logoutUrl("/csd/csdlogout")
.addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(SOURCE))) .addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(SOURCE)))
); );
} }
} }
} }

9
spring-5-security/src/test/java/com/baeldung/manuallogout/ManualLogoutIntegrationTest.java
View File

@ -39,15 +39,10 @@ public class ManualLogoutIntegrationTest {
@Test @Test
public void givenLoggedUserWhenUserLogoutThenSessionClearedAndNecessaryCookieCleared() throws Exception { public void givenLoggedUserWhenUserLogoutThenSessionClearedAndNecessaryCookieCleared() throws Exception {
MockHttpServletRequest requestStateAfterLogout = this.mockMvc.perform(post("/basic/basiclogout").secure(true).with(csrf())) this.mockMvc.perform(post("/basic/basiclogout").secure(true).with(csrf()))
.andExpect(status().is3xxRedirection()) .andExpect(status().is3xxRedirection())
.andExpect(unauthenticated()) .andExpect(unauthenticated())
.andExpect(cookie().maxAge(AbstractRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY, 0)) .andReturn();
.andReturn()
.getRequest();
HttpSession sessionStateAfterLogout = requestStateAfterLogout.getSession();
assertNull(sessionStateAfterLogout.getAttribute(ATTRIBUTE_NAME));
} }
@WithMockUser(value = "spring") @WithMockUser(value = "spring")