春季安全注销答案

【问题标题】：Spring Security Logout春季安全注销
【发布时间】：2015-03-13 10:49:51
【问题描述】：

我在使用 Spring Security 时遇到了麻烦。我可以登录但不能注销（至少不像预期的那样）。

登录后，我将被重定向到 /secure/home.xhtml

到目前为止的代码：

index.xhtm

<form method="POST" id="loginForm" action="#{request.contextPath}/j_spring_security_check" class="form-signin" autocomplete="off">
            <div class="form-group">
                <label for="username" class="control-label">#{bundle["login.username"]}</label>
                <input type="text" name="username" id="username" class="input-block-level form-control"
                       placeholder="#{bundle['label.username']}" required="true" tabindex="1" />
                <span class="help-block"></span>
            </div>
            <div class="form-group">
                <label for="password" class="control-label">#{bundle["login.password"]}</label>
                <input type="password" class="input-block-level form-control" name="password" id="password" tabindex="2"
                       placeholder="#{bundle['label.password']}" required="true" />
                <span class="help-block"></span>
            </div>
            <button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["login.action"]}</button>
            <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
        </form>

spring-security.xhtml, http 配置

<security:http use-expressions="true" >
        <security:intercept-url pattern="/secure/**" access="hasAnyRole('USER','ADMIN')" />
        <security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
        <!--<security:access-denied-handler error-page="/404.xhtml" />-->
        <security:form-login 
            login-page="/index.xhtml" 
            default-target-url="/secure/home.xhtml" 
            authentication-failure-url="/index.xhtml?error"
            username-parameter="username" 
            password-parameter="password" />
        <security:logout logout-url="/logout" logout-success-url="/index.xhtml?logout" invalidate-session="true" delete-cookies="JSESSIONID" />
        <security:csrf />
    </security:http>

这是我尝试在 stackoverflow 上针对其他答案实现注销的方式：

<a href="#{request.contextPath}/logout">logout</a>
                    <h:outputLink value="#{request.contextPath}/logout">Logout</h:outputLink>

但是两个链接都不起作用。我得到了 404。我还读到你应该用 pageContext.request.contextPath 替换 request.contextPath 但这也不起作用。（而不是 localhost:8080/myContext/logout 链接会将我重定向到 localhost:8080/logout）

一个教程告诉我，注销也可以用这个实现：

<form method="POST" id="loginForm" action="#{request.contextPath}/logout" class="form-signin" autocomplete="off">
                        <button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["logout.action"]}</button>
                        <input type="hidden" name="#{_csrf.parameterName}" value="#{_csrf.token}" />
                    </form>

一开始它似乎解决了我的问题，但是在将更多页面添加到安全部分后，例如“profile.xhtml”，我遇到了加载页面后退出的不良行为。因此，如果我在 home.xhtml 中添加上面的注销表单，即使我没有单击注销，我似乎也会被注销。如果我刷新页面，即使我没有单击注销，我也会被重定向到 index.xhtml（登录）。因此，如果我单击指向 profile.xhtml 的链接，我自然会被重定向到 index.xhtml，因为 spring 认为我已注销。如果没有此表格，我会保持登录状态，但无法注销！真是一团糟！

啊，如果我点击表单上的注销按钮，我会收到以下错误：

HTTP Status 403 - Expected CSRF token not found. Has your session expired?

type Status report

messageExpected CSRF token not found. Has your session expired?

descriptionAccess to the specified resource has been forbidden.

我真的不知道我的配置有什么问题:(！

这是我的 web.xml：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">
    <context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
        <param-value>messages</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.DEFAULT_SUFFIX</param-name>
        <param-value>.xhtml</param-value>
    </context-param> 
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath:/application-context.xml
            classpath:/application-security.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <listener>
        <listener-class>com.sun.faces.config.ConfigureListener</listener-class>
    </listener>

    <!-- Predefined pages -->
    <welcome-file-list>
        <welcome-file>index.xhtml</welcome-file>
    </welcome-file-list>
    <!--    <error-page>
        <error-code>403</error-code>
        <location>/error.xhtml</location>
    </error-page>-->
    <error-page>
        <error-code>404</error-code>
        <location>/404.xhtml</location>
    </error-page>
    <error-page>
        <error-code>500</error-code>
        <location>/error.xhtml</location>
    </error-page>
    <error-page>
        <exception-type>javax.faces.application.ServletException</exception-type>
        <location>/index.xhtml</location>
    </error-page>
    <error-page>
        <exception-type>java.lang.Exception</exception-type>
        <location>/error.xhtml</location>
    </error-page>

    <session-config>
        <session-timeout>30</session-timeout>
    </session-config>

    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.xhtml</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/logout</url-pattern>
    </filter-mapping>

    <!-- MIME TYPES -->
    <mime-mapping>
        <extension>css</extension>
        <mime-type>text/css</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>eot</extension>  
        <mime-type>application/x-font-eot</mime-type>  
    </mime-mapping>
    <mime-mapping>
        <extension>js</extension>
        <mime-type>text/javascript</mime-type>
    </mime-mapping>
    <mime-mapping>
        <extension>latex</extension>
        <mime-type>application/x-latex</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>otf</extension>  
        <mime-type>application/x-font-opentype</mime-type>  
    </mime-mapping>   
    <mime-mapping>
        <extension>roff</extension>
        <mime-type>application/x-troff</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>svg</extension>  
        <mime-type>application/svg+xml</mime-type>  
    </mime-mapping>
    <mime-mapping>  
        <extension>ttf</extension>  
        <mime-type>application/x-font-ttf</mime-type>  
    </mime-mapping>
    <mime-mapping>  
        <extension>woff</extension>  
        <mime-type>application/x-font-woff</mime-type>  
    </mime-mapping> 
    <mime-mapping>  
        <extension>woff2</extension>  
        <mime-type>application/x-font-woff2</mime-type>  
    </mime-mapping>
</web-app>

使用 GlassFish 4.1、spring framework 版本 4.1.2.RELEASE 和 spring security 版本 3.2.5.RELEASE。

我会很感激每一个答案。这个错误已经花了两天时间没有任何解决方案:(

【问题讨论】：

标签： java spring security logout

【解决方案1】：

您已启用 CRLF 保护。

您可以尝试通过将其添加到您的表单来支持 CRLF：

<input type="hidden"
    name="${_csrf.parameterName}"
    value="${_csrf.token}"/>

如果这不起作用，您可以删除 CSRF - 尽管不建议这样做。

【讨论】：

【解决方案2】：

使用 spring url taglig 或 jstl url taglib 写下你的 url。 This post 适合学习spring security configure

【讨论】：