当我尝试访问我的
spring应用程序的注销URL时,我的服务器日志中发现了一个404错误,并且在DispatcherServlet中使用名称为“mvc-dispatcher”的URI [/ logout]找到HTTP请求.
我已经尝试了Call to j_spring_security_logout not working,Issue with Spring security’s logout和几乎所有相关的结果.
我正在包括完整的配置文件,因为Spring xml结构对我来说还不是很清楚.
我的安全配置:
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <http pattern="/resources/**" security="none" /> <http auto-config="true"> <intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> <intercept-url pattern="/**" access="ROLE_USER" /> <form-login login-page="/login" default-target-url="/"/> <logout logout-url="/logout" /> <csrf /> </http> <global-method-security secured-annotations="enabled" /> <authentication-manager> <authentication-provider user-service-ref="userDetailsService" /> </authentication-manager> </beans:beans>
我的web.xml是这样的:
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <display-name>XYZ</display-name> <context-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/spring/*-config.xml</param-value> </context-param> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <servlet> <servlet-name>mvc-dispatcher</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>mvc-dispatcher</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> </web-app>
如何使注销页面工作?
解决方法
如果您使用CSRF注销,则必须执行POST.见
http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf-logout