Spring Security 和自定义记住我过滤器：注销问题答案

【问题标题】：Spring Security and custom Remember me filter: logout issueSpring Security 和自定义记住我过滤器：注销问题
【发布时间】：2015-05-22 03:29:20
【问题描述】：

我需要定义一个自定义的 RememberMeAuthenticationFilter 以便我可以覆盖onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) 方法来放置一些自定义逻辑。

我已配置 XML 以使用我的自定义过滤器：

 <security:http disable-url-rewriting="true" request-matcher-ref="excludeUrlRequestMatcher" entry-point-ref="authenticationEntryPoint">
    <security:custom-filter position="FORM_LOGIN_FILTER" ref="usernamePasswordAuthenticationFilter"/>
    <security:custom-filter position="REMEMBER_ME_FILTER" ref="extRememberMeProcessingFilter"/>

    <security:anonymous username="anonymous" granted-authority="ROLE_ANONYMOUS"/>

    <security:session-management session-authentication-strategy-ref="fixation" />

    <!-- Intercepts url HERE: removed for brevity -->

    <!--<security:form-login: using custom filter -->
            <!--login-page="/login"-->
            <!--authentication-failure-handler-ref="loginAuthenticationFailureHandler"-->
            <!--authentication-success-handler-ref="loginGuidAuthenticationSuccessHandler"/>-->


    <security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler"/>

    <security:port-mappings>
        <security:port-mapping http="#{configurationService.configuration.getProperty('tomcat.http.port')}"
                               https="#{configurationService.configuration.getProperty('tomcat.ssl.port')}"/>
        <security:port-mapping http="80" https="443"/>
        <!--security:port-mapping http="#{configurationService.configuration.getProperty('proxy.http.port')}"
            https="#{configurationService.configuration.getProperty('proxy.ssl.port')}" /-->
    </security:port-mappings>

    <security:request-cache ref="httpSessionRequestCache"/>

    <security:access-denied-handler ref="b2bAccessDeniedHandler"/>

    <!-- RememberMe: using custom filter -->
    <!--<security:remember-me key="comtestrememberme" services-ref="rememberMeServices"/>-->

</security:http>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="myAuthenticationProvider"/>
    <security:authentication-provider ref="rememberMeAuthenticationProvider"/>
</security:authentication-manager>

<bean id="myAuthenticationProvider"
      class="com.test.security.MyAuthenticationProvider">
    <property name="bruteForceAttackCounter" ref="bruteForceAttackCounter"/>
    <property name="customerService" ref="customerService"/>
    <aop:scoped-proxy/>
</bean>

<bean id="rememberMeServices"
      class="com.test.security.MyRememberMeServices">
    <property name="key" value="comtestrememberme"/>
    <property name="cookieName" value="myRememberMe"/>
    <property name="alwaysRemember" value="false"/>
    <property name="customerService" ref="customerService"/>
    <property name="useSecureCookie" value="false"/>
    <aop:scoped-proxy/>
</bean>

<bean id="rememberMeAuthenticationProvider"
      class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
    <property name="key" value="comtestrememberme"/>
    <aop:scoped-proxy/>
</bean>

<bean id="usernamePasswordAuthenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="filterProcessesUrl" value="/j_spring_security_check"/>
    <property name="rememberMeServices" ref="rememberMeServices"/>
    <property name="authenticationSuccessHandler" ref="loginGuidAuthenticationSuccessHandler"/>
    <property name="authenticationFailureHandler" ref="loginAuthenticationFailureHandler"/>
</bean>

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <property name="loginFormUrl" value="/login"/>
</bean>

<bean id="extRememberMeProcessingFilter" class="com.test.security.filters.ExtRememberMeAuthenticationFilter">
    <property name="rememberMeServices" ref="rememberMeServices"/>
    <property name="authenticationManager" ref="authenticationManager"/>
</bean>

正在创建记住我的 cookie，并且正在使用我的自定义过滤器，但问题是永远不会发生注销。

当我点击注销按钮时，看起来我正在再次进行身份验证过程并且客户再次登录。

如果我恢复到标准 Spring 过滤器，一切正常。

我是否遗漏了配置中的某些内容？

【问题讨论】：

spring 不会为position="REMEMBER_ME_FILTER" 抛出错误？
不，因为我注释掉了 remember-me 标签。

标签： spring spring-security remember-me

【解决方案1】：

这里可能发生的情况是 - 您的注销工作正常，但您没有在注销时删除 myRememberMe cookie。因此，当您的会话在注销时失效时，请记住我的服务正在使用 myRememberMe cookie 创建一个新会话。

解决方案：您可以通过在<security:logout> 标签中添加delete-cookies 属性来修改您的配置。

<security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler" delete-cookies="JSESSIONID,myRememberMe" />

【讨论】：