1

I have web app with spring security 4.2.3.RELEASE.

Security config:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
        .antMatchers("/s/**").permitAll()
        .antMatchers("/changePassword").permitAll()
        .antMatchers("/changePasswordPerform").permitAll()
        .anyRequest().authenticated()
        .and()
    .formLogin()
        .loginPage("/login")
        .permitAll()
        .defaultSuccessUrl("/home", true)
        .failureHandler(customAuthenticationHandler)
        .and()
    .logout()
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
        .permitAll()
}

Controller

@RequestMapping(value = "/login")
public ModelAndView login(HttpServletRequest request,
       @RequestParam(value = "logout", required = false) String logout) {

    ModelAndView model = new ModelAndView();
    if (logout != null) {
        model.addObject("msg", "logout successfully");
    }

    model.setViewName("login-new"); 
    return model;
}

All works fine (After logout I get a message "logout successfully" , page is ../login?logout). Now I am trying to audit my logout events. For that propose I add

@Component
public class CustomLogoutSuccessHandler implements LogoutSuccessHandler {

@Override
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
        throws IOException, ServletException {
    //audit logic here

    String URL = request.getContextPath() + "/login?logout";        
    response.setStatus(HttpStatus.OK.value());
    response.sendRedirect(URL); 
}

}

and changed my security config

    .logout()
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
        .permitAll()
        .logoutSuccessHandler(customLogoutSuccessHandler);

Logout still works, but now I am not getting message "logout successfully". And logout page is ../login (not ../login?logout). How can I get my message back?

sare3th
  • 758
  • 9
  • 20

0 Answers0