Spring Security之LogoutSuccessHandler注銷成功操作方式

更新時間：2024年08月01日 14:56:04 作者：杜小舟

這篇文章主要介紹了Spring Security之LogoutSuccessHandler注銷成功操作方式,具有很好的參考價值,希望對大家有所幫助,如有錯誤或未考慮完全的地方,望不吝賜教

前言

LogoutSuccessHandler 接口定義了在用戶成功注銷后執(zhí)行的操作。

當(dāng)用戶從應(yīng)用程序中注銷時，這個處理器被觸發(fā)。

它允許我們開發(fā)者自定義注銷成功后的行為，例如重定向到特定頁面、顯示注銷確認信息、進行清理工作或其他自定義邏輯。

接下來先簡單介紹官方的處理器，再自己自定義一個處理器。

官方給的處理器

SimpleUrlLogoutSuccessHandler

注銷成功后重定向到一個URL地址。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);

        http
                // 退出登錄
                .logout()
                // 退出登錄成功后處理器
                .logoutSuccessHandler(logoutSuccessHandler());
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        SimpleUrlLogoutSuccessHandler logoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
        // 注銷成功后重定向的地址
        logoutSuccessHandler.setDefaultTargetUrl("/logout");
        return logoutSuccessHandler;
    }

ForwardLogoutSuccessHandler

注銷成功后轉(zhuǎn)發(fā)到一個URL地址。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);

        http
                // 退出登錄
                .logout()
                // 退出登錄成功后處理器
                .logoutSuccessHandler(logoutSuccessHandler());
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
    	// 轉(zhuǎn)發(fā)地址
        return new ForwardLogoutSuccessHandler("/logout");
    }

HttpStatusReturningLogoutSuccessHandler

不做重定向也不做轉(zhuǎn)發(fā)，而是返回一個指定的HTTP狀態(tài)碼。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);

        http
                // 退出登錄
                .logout()
                // 退出登錄成功后處理器
                .logoutSuccessHandler(logoutSuccessHandler());
    }
    
    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        // 也可以指定其他狀態(tài)碼
        return new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK);
    }

DelegatingLogoutSuccessHandler

DelegatingLogoutSuccessHandler 用于處理用戶注銷成功后根據(jù)不同的請求條件選擇并執(zhí)行相應(yīng)的 LogoutSuccessHandler。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);

        http
                // 退出登錄
                .logout()
                // 退出登錄成功后處理器
                .logoutSuccessHandler(logoutSuccessHandler());
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        LinkedHashMap<RequestMatcher, LogoutSuccessHandler> matcherToHandler = new LinkedHashMap<>();
        // 配置不同的RequestMatcher和對應(yīng)的LogoutSuccessHandler
        // 配置在 /admin/** 路徑下退出登錄匹配的 SimpleUrlLogoutSuccessHandler
        SimpleUrlLogoutSuccessHandler simpleUrlLogoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
        simpleUrlLogoutSuccessHandler.setDefaultTargetUrl("/admin-logout");
        matcherToHandler.put(new AntPathRequestMatcher("/admin/**"), simpleUrlLogoutSuccessHandler);

        // 配置在 /user/** 路徑下退出登錄匹配的 ForwardLogoutSuccessHandler
        matcherToHandler.put(new AntPathRequestMatcher("/user/**"), new ForwardLogoutSuccessHandler("/user-logout"));

        DelegatingLogoutSuccessHandler handler = new DelegatingLogoutSuccessHandler(matcherToHandler);
        // 配置默認的 ForwardLogoutSuccessHandler
        handler.setDefaultLogoutSuccessHandler(new ForwardLogoutSuccessHandler("/default-logout"));
        
        return handler;
    }

自定義處理器

package com.security.handler.logout;

import com.alibaba.fastjson2.JSON;
import com.security.controller.vo.ResponseResult;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.stereotype.Component;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


@Component
@Slf4j
public class LogoutSuccessHandlerImpl implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        log.info("退出登錄成功 ...");

        /**
         * 設(shè)置響應(yīng)狀態(tài)值
         */
        response.setStatus(200);
        response.setContentType("application/json");
        response.setCharacterEncoding("utf-8");
        String json = JSON.toJSONString(
                ResponseResult.builder()
                        .code(200)
                        .message("退出登錄成功!")
                        .build());

        // JSON信息
        response.getWriter().println(json);
    }
}

package com.security.config;

import com.security.handler.logout.LogoutSuccessHandlerImpl;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.web.cors.CorsConfiguration;


@Configuration
@EnableWebSecurity
// 開啟限制訪問資源所需權(quán)限
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfigurationTest extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);

        http
                // 退出登錄
                .logout()
                // 退出登錄成功后處理器
                .logoutSuccessHandler(logoutSuccessHandler());
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        return new LogoutSuccessHandlerImpl();
    }
    
}