SpringSecurity如何退出登录

⒈如何退出登录？　　

　　SpringSecurity默认为我们提供了退出操作，我们只需要访问特定的url就可以退出登录了

 1 <!DOCTYPE html>
 2 <html lang="en">
 3 <head>
 4     <meta charset="UTF-8">
 5     <title>退出登录</title>
 6 </head>
 7 <body>
 8     <a href="/logout">退出登录</a>
 9 </body>
10 </html>

⒉SpringSecurity默认为我们做了什么？

　　1.使当前Session失效

　　2.清除与当前用户相关的remember-me记录

　　3.清空当前的SecurityContext

　　4.重定向到登陆页面

⒊我们如何自定义退出登录

 1 package cn.coreqi.security.config;
 2 
 3 import cn.coreqi.security.Filter.SmsCodeFilter;
 4 import cn.coreqi.security.Filter.ValidateCodeFilter;
 5 import cn.coreqi.security.handler.CoreqiLogoutSuccessHandler;
 6 import org.springframework.beans.factory.annotation.Autowired;
 7 import org.springframework.context.annotation.Bean;
 8 import org.springframework.context.annotation.Configuration;
 9 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
10 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
11 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
12 import org.springframework.security.crypto.password.PasswordEncoder;
13 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
14 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
15 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
16 
17 @Configuration
18 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19 
20     @Autowired
21     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;
22 
23     @Autowired
24     private AuthenticationFailureHandler coreqiAuthenticationFailureHandler;
25 
26     @Autowired
27     private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
28 
29     @Bean
30     public PasswordEncoder passwordEncoder(){
31         return NoOpPasswordEncoder.getInstance();
32     }
33 
34 
35     @Override
36     protected void configure(HttpSecurity http) throws Exception {
37         ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
38         validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler);
39 
40         SmsCodeFilter smsCodeFilter = new SmsCodeFilter();
41 
42 
43         //http.httpBasic()    //httpBasic登录 BasicAuthenticationFilter
44         http.addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加载用户名密码过滤器的前面
45                 .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加载用户名密码过滤器的前面
46                 .formLogin()    //表单登录 UsernamePasswordAuthenticationFilter
47                     .loginPage("/coreqi-signIn.html")  //指定登录页面
48                     //.loginPage("/authentication/require")
49                     .loginProcessingUrl("/authentication/form") //指定表单提交的地址用于替换UsernamePasswordAuthenticationFilter默认的提交地址
50                     .successHandler(coreqiAuthenticationSuccessHandler) //登录成功以后要用我们自定义的登录成功处理器，不用Spring默认的。
51                     .failureHandler(coreqiAuthenticationFailureHandler) //自己体会把
52                 .and()
53                 .logout()   //退出登录相关配置
54                     .logoutUrl("signOut")   //自定义退出登录页面
55                     .logoutSuccessHandler(new CoreqiLogoutSuccessHandler()) //退出成功后要做的操作（如记录日志），和logoutSuccessUrl互斥
56                     //.logoutSuccessUrl("/index") //退出成功后跳转的页面
57                     .deleteCookies("JSESSIONID")    //退出时要删除的Cookies的名字
58                 .and()
59                 .authorizeRequests()    //对授权请求进行配置
60                     .antMatchers("/coreqi-signIn.html","/code/image","/session/invalid").permitAll() //指定登录页面不需要身份认证
61                     .anyRequest().authenticated()  //任何请求都需要身份认证
62                     .and().csrf().disable()    //禁用CSRF
63                 .apply(smsCodeAuthenticationSecurityConfig);
64             //FilterSecurityInterceptor 整个SpringSecurity过滤器链的最后一环
65     }
66 }