1. logout
- 使用session失效
- 如果配置了rememberme, 則清除rememberme認(rèn)證
- 清除SecurityContextHolder
- 重定向到
/login?logout
2. 自定義配置
protected void configure(HttpSecurity http) throws Exception {
http
.logout(logout -> logout
.logoutUrl("/my/logout")
.logoutSuccessUrl("/my/index")
.logoutSuccessHandler(logoutSuccessHandler)
.invalidateHttpSession(true)
.addLogoutHandler(logoutHandler)
.deleteCookies(cookieNamesToClear)
)
...
}
如果要自定義logout功能, 可以添加LogoutHandler或LogoutSuccessHandler
3. LogoutHandler
LogoutHandler是用于定義logout功能, 主要是執(zhí)行一些必要的清理. 這些類不應(yīng)該拋出異常.
4. LogoutSuccessHandler
在logout成功后由LogoutFilter調(diào)用, 以處理轉(zhuǎn)發(fā)或重定向功能. 與LogoutHandler功能幾乎相同, 但它可拋出異常.
實(shí)現(xiàn)有:
- SimpleUrlLogoutSuccessHandler
- HttpStatusReturningLogoutSuccessHandler 適用于REST api場(chǎng)景.
