4

I was reading many tutorials and none of them is working for me... I use Spring 3.1.x with Spring Security. I have a bunch of secured url and many unsecured. Now, when the user is logged in and tries to logout I want him to stay in the same page as he was before so I use this:

<beans:bean id="logoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
    <beans:property name="useReferer" value="true"/>
</beans:bean>

This works fine, however when the user logs out from the secured page it redirects him to the login page, and I would like to redirect to home page.. How can I achieve this? Thanks in advance!

0

3 Answers 3

7

Since you have custom logic for redirecting, you need a custom LogoutSuccessHandler. In this handler, you need to add this logic:

String refererUrl = request.getHeader("Referer");
String normalizedRefererUrl = ...; // "Normalize" (if needed) the URL so it is in the form that you need.

if (requiresAuthentication(normalizedRefererUrl, authentication)) {
    response.sendRedirect(request.getContextPath()); // home page
} else {
    response.sendRedirect(refererUrl); // or normalizedUrl
}

In your requiresAuthentication() method, you need to use some part of Spring Security that determined if the URL needs authentication.
You can use a WebInvocationPrivilegeEvaluator reference there. You get a hold of it through Spring through autowiring by class (since there will be a bean implementing WebInvocationPrivilegeEvaluator).
The evaluator has a method that you can use, isAllowed(uri, authentication).

5
  • I like this solution most, however we have two <http> elements in the configuration so also Two WebInvocationPrivilegeEvaluator in the context, so the autowireing is not working.. ANy idas how to solve this?
    – Mat
    Commented Jul 16, 2012 at 7:41
  • I solved the problem, but now strange thing happens, whever I log out, the Authentication object that I receive in the custom Logout Handler is always authenticated (even though the logout is called properly..) any thoughts?
    – Mat
    Commented Jul 16, 2012 at 9:10
  • @Mat What do you mean by "is always authenticated"? Are you referring to the fact that the Authentication object is allways not null? Commented Jul 16, 2012 at 13:32
  • Ok, now I understand, it was my mistake. The Authentication object is not null and it's filled with the data of the user that used to be logged in before.. This solution is not the best, because isAlowed() will always return true when checking with the Authentication from before the logout (as we were on this site, so we have grants to be there...). When I pass null =, however, it always returns false;) What I did was parsing the URL and checking if it fits my seucure rules. I don't like this solution, but it works..
    – Mat
    Commented Jul 17, 2012 at 12:54
  • @Matt How did you solve the problem? I am getting 5 WebInvocationPrivilegeEvaluator and not sure which one to use for a given url.
    – DairyLea
    Commented Jul 3, 2013 at 14:32
5
<security:http auto-config="true">
    <security:form-login login-page="/spring/login" 
                         login-processing-url="/spring/loginProcess"
                         default-target-url="/spring/main" 
                         authentication-failure-url="/spring/login?login_error=1" />  
    <security:logout logout-url="/spring/logout" logout-success-url="/spring/logout-success" />
</security:http>

logout-success-url from the docs or for a custom succeshandler

1
  • This wont work, it would redirec me always to the same, hardcoded URL. I want to redirect once the current URL, once to home page (depending on where the user is). What's more it's illegal to use logout-success-url with success-handler-ref (throws configuration exceptions on startup..)
    – Mat
    Commented Jul 12, 2012 at 15:28
0

as per documentation for spring security if you don't specify logout-success-url then it should be redirecting /. check this configuration and may be you can use SimpleRedirectInvalidSessionStrategy

2
  • Also the same problem. I don't want to redirect to "/" always, only when user logs out from secured page, otherwise redirect to the same url that he comes from..
    – Mat
    Commented Jul 12, 2012 at 15:36
  • then i think you should write custom success handler as suggested by Nicolae Albu Commented Jul 13, 2012 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.