blocks|key|4655845|text|您可以通过以下方式以编程方式注销：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4655846|public+void+logout(HttpServletRequest+request,+HttpServletResponse+response)+{
++++Authentication+auth+=+SecurityContextHolder.getContext().getAuthentication();
++++++if+(auth+!=+null){++++
+++++++++new+SecurityContextLogoutHandler().logout(request,+response,+auth);
++++++}
++++SecurityContextHolder.getContext().setAuthentication(null);
}|code-block|syntax|javascript|4655847|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Programmatically you can log out this way:

<pre><code>public void logout(HttpServletRequest request, HttpServletResponse response) {
 Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 if (auth != null){ 
 new SecurityContextLogoutHandler().logout(request, response, auth);
 }
 SecurityContextHolder.getContext().setAuthentication(null);
}
</code></pre>

blocks|key|149433|text|在<http></http>标签中添加以下行。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|149434|<logout+invalidate-session="true"+logout-url="/logout"+delete-cookies="JSESSIONID"+/>|code-block|syntax|javascript|149435|这将删除JSESSIONID并使会话无效。与注销按钮或标签的链接如下所示：|149436|<a+href="${pageContext.request.contextPath}/logout">Logout</a>|149437|编辑:您想要使java代码中的会话无效。我假设您必须在注销用户之前执行一些任务，然后使会话无效。如果是这样的用例，您应该使用客户注销处理程序。有关更多信息，请访问this站点。|149438|entityMap|0|LINK|mutability|MUTABLE|url|http://www.baeldung.com/spring-security-logout^0|1|D|0|0|0|0|29|4|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|11|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|12|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|14|8|@]|D|@$9|15|A|16|1|17]]|E|$]]|$1|Q|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|R|$S|$5|T|U|V|E|$W|X]]]]

Add following line in <code>&lt;http&gt;&lt;/http&gt;</code> tag.

<pre><code>&lt;logout invalidate-session="true" logout-url="/logout" delete-cookies="JSESSIONID" /&gt;
</code></pre>

This will delete JSESSIONID and invalidate session. And link to logout button or label would be something like: 

<pre><code>&lt;a href="${pageContext.request.contextPath}/logout"&gt;Logout&lt;/a&gt;
</code></pre>

EDIT:
You want to invalidate session from java code. I assume you have to do some task right before logging the user out, and then invalidate session. If this is the use case, you should use custome logout handlers. Visit <a href="http://www.baeldung.com/spring-security-logout" rel="nofollow">this</a> site for more information.

blocks|key|149478|text|下面是我的实现(Spring+OAuth2)：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|149479|@Controller
public+class+OAuthController+{
++++@Autowired
++++private+TokenStore+tokenStore;

++++@RequestMapping(value+=+"/oauth/revoke-token",+method+=+RequestMethod.GET)
++++@ResponseStatus(HttpStatus.OK)
++++public+void+logout(HttpServletRequest+request)+{
++++++++String+authHeader+=+request.getHeader("Authorization");
++++++++if+(authHeader+!=+null)+{
++++++++++++String+tokenValue+=+authHeader.replace("Bearer",+"").trim();
++++++++++++OAuth2AccessToken+accessToken+=+tokenStore.readAccessToken(tokenValue);
++++++++++++tokenStore.removeAccessToken(accessToken);
++++++++}
++++}
}|code-block|syntax|javascript|149480|用于测试：|149481|curl+-X+GET+-H+"Authorization:+Bearer+$TOKEN"+http://localhost:8080/backend/oauth/revoke-token|149482|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

Here's my implementation (Spring OAuth2):

<pre><code>@Controller
public class OAuthController {
 @Autowired
 private TokenStore tokenStore;

 @RequestMapping(value = "/oauth/revoke-token", method = RequestMethod.GET)
 @ResponseStatus(HttpStatus.OK)
 public void logout(HttpServletRequest request) {
 String authHeader = request.getHeader("Authorization");
 if (authHeader != null) {
 String tokenValue = authHeader.replace("Bearer", "").trim();
 OAuth2AccessToken accessToken = tokenStore.readAccessToken(tokenValue);
 tokenStore.removeAccessToken(accessToken);
 }
 }
}
</code></pre>

For testing:

<pre><code>curl -X GET -H "Authorization: Bearer $TOKEN" http://localhost:8080/backend/oauth/revoke-token
</code></pre>

blocks|key|4655949|text|通过使用Spring+OAuth提供的接口，可以改善camposer的响应。实际上，不需要直接访问HTTP头，但可以按如下方式实现移除访问令牌的REST方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4655950|@Autowired
private+AuthorizationServerTokenServices+authorizationServerTokenServices;

@Autowired
private+ConsumerTokenServices+consumerTokenServices;

@RequestMapping("/uaa/logout")
public+void+logout(Principal+principal,+HttpServletRequest+request,+HttpServletResponse+response)+throws+IOException+{

++++OAuth2Authentication+oAuth2Authentication+=+(OAuth2Authentication)+principal;
++++OAuth2AccessToken+accessToken+=+authorizationServerTokenServices.getAccessToken(oAuth2Authentication);
++++consumerTokenServices.revokeToken(accessToken.getValue());

++++String+redirectUrl+=+getLocalContextPathUrl(request)%2B"/logout?myRedirect="%2BgetRefererUrl(request);
++++log.debug("Redirect+URL:+{}",redirectUrl);

++++response.sendRedirect(redirectUrl);

++++return;
}|code-block|syntax|javascript|4655951|我还添加了到Spring+Security注销过滤器端点的重定向，因此会话无效，客户端必须再次提供凭据才能访问/oauth/authorize端点。|4655952|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/3090309/camposer^0|Q|8|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]]]

The response by <a href="https://stackoverflow.com/users/3090309/camposer">camposer</a> can be improved using the API provided by Spring OAuth. In fact, it's not necessary to access directly to the HTTP headers, but the REST method which removes the access token can be implemented as follows:

<pre><code>@Autowired
private AuthorizationServerTokenServices authorizationServerTokenServices;

@Autowired
private ConsumerTokenServices consumerTokenServices;

@RequestMapping("/uaa/logout")
public void logout(Principal principal, HttpServletRequest request, HttpServletResponse response) throws IOException {

 OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) principal;
 OAuth2AccessToken accessToken = authorizationServerTokenServices.getAccessToken(oAuth2Authentication);
 consumerTokenServices.revokeToken(accessToken.getValue());

 String redirectUrl = getLocalContextPathUrl(request)+"/logout?myRedirect="+getRefererUrl(request);
 log.debug("Redirect URL: {}",redirectUrl);

 response.sendRedirect(redirectUrl);

 return;
}
</code></pre>

I also added a redirect to the endpoint of Spring Security logout filter, so the session is invalidated and the client must provide credentials again in order to access to the /oauth/authorize endpoint.

blocks|key|149577|text|这取决于您正在使用的oauth2“授权类型”的类型。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|149578|如果你在客户端应用中使用过spring的@EnableOAuth2Sso，最常见的就是'Authorization+Code‘。在这种情况下，Spring+security会将登录请求重定向到“Authorization+Server”，并使用从“Authorization+Server”接收的数据在客户端应用程序中创建一个会话。|offset|length|style|CODE|149579|你可以很容易地在调用/logout端点的客户端应用程序上销毁你的会话，但是客户端应用程序会再次将用户发送到“授权服务器”，并再次返回logged。|149580|我建议创建一种机制来拦截客户端应用程序的注销请求，并在此服务器代码中调用“授权服务器”来使令牌无效。|149581|我们需要的第一个更改是使用Claudio+Tasso建议的代码在授权服务器上创建一个端点，以使用户的access_token无效。|149582|@Controller
@Slf4j
public+class+InvalidateTokenController+{


++++@Autowired
++++private+ConsumerTokenServices+consumerTokenServices;


++++@RequestMapping(value="/invalidateToken",+method=+RequestMethod.POST)
++++@ResponseBody
++++public+Map<String,+String>+logout(@RequestParam(name+=+"access_token")+String+accessToken)+{
++++++++LOGGER.debug("Invalidating+token+{}",+accessToken);
++++++++consumerTokenServices.revokeToken(accessToken);
++++++++Map<String,+String>+ret+=+new+HashMap<>();
++++++++ret.put("access_token",+accessToken);
++++++++return+ret;
++++}
}|code-block|syntax|javascript|149583|然后在客户端应用程序中创建一个LogoutHandler|149584|@Slf4j
@Component
@Qualifier("mySsoLogoutHandler")
public+class+MySsoLogoutHandler+implements+LogoutHandler+{

++++@Value("${my.oauth.server.schema}://${my.oauth.server.host}:${my.oauth.server.port}/oauth2AuthorizationServer/invalidateToken")
++++String+logoutUrl;

++++@Override
++++public+void+logout(HttpServletRequest+httpServletRequest,+HttpServletResponse+httpServletResponse,+Authentication+authentication)+{

++++++++LOGGER.debug("executing+MySsoLogoutHandler.logout");
++++++++Object+details+=+authentication.getDetails();
++++++++if+(details.getClass().isAssignableFrom(OAuth2AuthenticationDetails.class))+{

++++++++++++String+accessToken+=+((OAuth2AuthenticationDetails)details).getTokenValue();
++++++++++++LOGGER.debug("token:+{}",accessToken);

++++++++++++RestTemplate+restTemplate+=+new+RestTemplate();

++++++++++++MultiValueMap<String,+String>+params+=+new+LinkedMultiValueMap<>();
++++++++++++params.add("access_token",+accessToken);

++++++++++++HttpHeaders+headers+=+new+HttpHeaders();
++++++++++++headers.add("Authorization",+"bearer+"+%2B+accessToken);

++++++++++++HttpEntity<String>+request+=+new+HttpEntity(params,+headers);

++++++++++++HttpMessageConverter+formHttpMessageConverter+=+new+FormHttpMessageConverter();
++++++++++++HttpMessageConverter+stringHttpMessageConverternew+=+new+StringHttpMessageConverter();
++++++++++++restTemplate.setMessageConverters(Arrays.asList(new+HttpMessageConverter[]{formHttpMessageConverter,+stringHttpMessageConverternew}));
++++++++++++try+{
++++++++++++++++ResponseEntity<String>+response+=+restTemplate.exchange(logoutUrl,+HttpMethod.POST,+request,+String.class);
++++++++++++}+catch(HttpClientErrorException+e)+{
++++++++++++++++LOGGER.error("HttpClientErrorException+invalidating+token+with+SSO+authorization+server.+response.status+code:+{},+server+URL:+{}",+e.getStatusCode(),+logoutUrl);
++++++++++++}
++++++++}


++++}
}|149585|并在WebSecurityConfigurerAdapter上注册|149586|@Autowired
MySsoLogoutHandler+mySsoLogoutHandler;

@Override
public+void+configure(HttpSecurity+http)+throws+Exception+{
++++//+@formatter:off
++++http
++++++++.logout()
++++++++++++.logoutSuccessUrl("/")
++++++++++++//+using+this+antmatcher+allows+/logout+from+GET+without+csrf+as+indicated+in
++++++++++++//+https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#csrf-logout
++++++++++++.logoutRequestMatcher(new+AntPathRequestMatcher("/logout"))
++++++++++++//+this+LogoutHandler+invalidate+user+token+from+SSO
++++++++++++.addLogoutHandler(mySsoLogoutHandler)
++++.and()
++++++++++++...
++++//+@formatter:on
}|149587|注意:如果您使用的是JWT+web令牌，则不能使其无效，因为该令牌不受授权服务器的管理。|149588|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/3350164/claudio-tasso^0|0|K|G|0|A|7|0|0|D|D|0|0|0|F|D|0|0|2|S|0|0|0^^$0|@$1|2|3|4|5|6|7|1A|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1B|8|@$D|1C|E|1D|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|1E|8|@$D|1F|E|1G|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|1H|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1I|8|@]|9|@$D|1J|E|1K|1|1L]]|A|$]]|$1|N|3|O|5|P|7|1M|8|@]|9|@]|A|$Q|R]]|$1|S|3|T|5|6|7|1N|8|@$D|1O|E|1P|F|G]]|9|@]|A|$]]|$1|U|3|V|5|P|7|1Q|8|@]|9|@]|A|$Q|R]]|$1|W|3|X|5|6|7|1R|8|@$D|1S|E|1T|F|G]]|9|@]|A|$]]|$1|Y|3|Z|5|P|7|1U|8|@]|9|@]|A|$Q|R]]|$1|10|3|11|5|6|7|1V|8|@]|9|@]|A|$]]|$1|12|3|-4|5|6|7|1W|8|@]|9|@]|A|$]]]|13|$14|$5|15|16|17|A|$18|19]]]]

It depends on type of oauth2 'grant type' that you're using.

The most common if your have used spring's <code>@EnableOAuth2Sso</code> in your client app is 'Authorization Code'. In this case Spring security redirects login request to the 'Authorization Server' and creates a session in your client app with the data received from 'Authorization Server'. 

You can easy destroy your session at the client app calling <code>/logout</code> endpoint, but then client app sends user again to 'authorization server' and returns logged again.

I propose to create a mechanism to intercept logout request at client app and from this server code, call "authorization server" to invalidate the token.

The first change that we need is create one endpoint at the authorization server, using the code proposed by <a href="https://stackoverflow.com/users/3350164/claudio-tasso">Claudio Tasso</a>, to invalidate the user's access_token.

<pre><code>@Controller
@Slf4j
public class InvalidateTokenController {


 @Autowired
 private ConsumerTokenServices consumerTokenServices;


 @RequestMapping(value="/invalidateToken", method= RequestMethod.POST)
 @ResponseBody
 public Map&lt;String, String&gt; logout(@RequestParam(name = "access_token") String accessToken) {
 LOGGER.debug("Invalidating token {}", accessToken);
 consumerTokenServices.revokeToken(accessToken);
 Map&lt;String, String&gt; ret = new HashMap&lt;&gt;();
 ret.put("access_token", accessToken);
 return ret;
 }
}
</code></pre>

Then at the client app, create a <code>LogoutHandler</code>:

<pre><code>@Slf4j
@Component
@Qualifier("mySsoLogoutHandler")
public class MySsoLogoutHandler implements LogoutHandler {

 @Value("${my.oauth.server.schema}://${my.oauth.server.host}:${my.oauth.server.port}/oauth2AuthorizationServer/invalidateToken")
 String logoutUrl;

 @Override
 public void logout(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) {

 LOGGER.debug("executing MySsoLogoutHandler.logout");
 Object details = authentication.getDetails();
 if (details.getClass().isAssignableFrom(OAuth2AuthenticationDetails.class)) {

 String accessToken = ((OAuth2AuthenticationDetails)details).getTokenValue();
 LOGGER.debug("token: {}",accessToken);

 RestTemplate restTemplate = new RestTemplate();

 MultiValueMap&lt;String, String&gt; params = new LinkedMultiValueMap&lt;&gt;();
 params.add("access_token", accessToken);

 HttpHeaders headers = new HttpHeaders();
 headers.add("Authorization", "bearer " + accessToken);

 HttpEntity&lt;String&gt; request = new HttpEntity(params, headers);

 HttpMessageConverter formHttpMessageConverter = new FormHttpMessageConverter();
 HttpMessageConverter stringHttpMessageConverternew = new StringHttpMessageConverter();
 restTemplate.setMessageConverters(Arrays.asList(new HttpMessageConverter[]{formHttpMessageConverter, stringHttpMessageConverternew}));
 try {
 ResponseEntity&lt;String&gt; response = restTemplate.exchange(logoutUrl, HttpMethod.POST, request, String.class);
 } catch(HttpClientErrorException e) {
 LOGGER.error("HttpClientErrorException invalidating token with SSO authorization server. response.status code: {}, server URL: {}", e.getStatusCode(), logoutUrl);
 }
 }


 }
}
</code></pre>

And register it at <code>WebSecurityConfigurerAdapter</code>:

<pre><code>@Autowired
MySsoLogoutHandler mySsoLogoutHandler;

@Override
public void configure(HttpSecurity http) throws Exception {
 // @formatter:off
 http
 .logout()
 .logoutSuccessUrl("/")
 // using this antmatcher allows /logout from GET without csrf as indicated in
 // https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#csrf-logout
 .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
 // this LogoutHandler invalidate user token from SSO
 .addLogoutHandler(mySsoLogoutHandler)
 .and()
 ...
 // @formatter:on
}
</code></pre>

One note: If you're using JWT web tokens, you can't invalidate it, because the token is not managed by the authorization server.

blocks|key|4656037|text|这适用于Keycloak机密客户端注销。我不知道为什么keycloak的人没有在java非web客户端和它们的端点上有更健壮的文档，我猜这就是开源lib的野兽的本质。我不得不花一点时间在他们的代码中：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4656038|++++//requires+a+Keycloak+Client+to+be+setup+with+Access+Type+of+Confidential,+then+using+the+client+secret
public+void+executeLogout(String+url){

++++HttpHeaders+requestHeaders+=+new+HttpHeaders();
++++//not+required+but+recommended+for+all+components+as+this+will+help+w/t'shooting+and+logging
++++requestHeaders.set(+"User-Agent",+"Keycloak+Thick+Client+Test+App+Using+Spring+Security+OAuth2+Framework");
++++//not+required+by+undertow,+but+might+be+for+tomcat,+always+set+this+header!
++++requestHeaders.set(+"Accept",+"application/x-www-form-urlencoded"+);

++++//the+keycloak+logout+endpoint+uses+standard+OAuth2+Basic+Authentication+that+inclues+the
++++//Base64-encoded+keycloak+Client+ID+and+keycloak+Client+Secret+as+the+value+for+the+Authorization+header
+++++createBasicAuthHeaders(requestHeaders);

++++//we+need+the+keycloak+refresh+token+in+the+body+of+the+request,+it+can+be+had+from+the+access+token+we+got+when+we+logged+in:
++++MultiValueMap<String,+String>+postParams+=+new+LinkedMultiValueMap<String,+String>();
++++postParams.set(+OAuth2Constants.REFRESH_TOKEN,+accessToken.getRefreshToken().getValue()+);

++++HttpEntity<MultiValueMap<String,+String>>+requestEntity+=+new+HttpEntity<MultiValueMap<String,+String>>(postParams,+requestHeaders);
++++RestTemplate+restTemplate+=+new+RestTemplate();
++++try+{
++++++++ResponseEntity<String>+response+=+restTemplate.exchange(url,+HttpMethod.POST,+requestEntity,+String.class);
++++++++System.out.println(response.toString());

++++}+catch+(HttpClientErrorException+e)+{
++++++++System.out.println("We+should+get+a+204+No+Content+-+did+we?\n"+%2B+e.getMessage());++++++++++
++++}
}+

//has+a+hard-coded+client+ID+and+secret,+adjust+accordingly
void+createBasicAuthHeaders(HttpHeaders+requestHeaders){
+++++String+auth+=+keycloakClientId+%2B+":"+%2B+keycloakClientSecret;
+++++byte[]+encodedAuth+=+Base64.encodeBase64(
++++++++auth.getBytes(Charset.forName("US-ASCII"))+);
+++++String+authHeaderValue+=+"Basic+"+%2B+new+String(+encodedAuth+);
+++++requestHeaders.set(+"Authorization",+authHeaderValue+);
}|code-block|syntax|javascript|4656039|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

This works for Keycloak Confidential Client logout. I have no idea why the folks over at keycloak don't have more robust docs on java non-web clients and their endpoints in general, I guess that's the nature of the beast with open source libs. I had to spend a bit of time in their code:

<pre><code> //requires a Keycloak Client to be setup with Access Type of Confidential, then using the client secret
public void executeLogout(String url){

 HttpHeaders requestHeaders = new HttpHeaders();
 //not required but recommended for all components as this will help w/t'shooting and logging
 requestHeaders.set( "User-Agent", "Keycloak Thick Client Test App Using Spring Security OAuth2 Framework");
 //not required by undertow, but might be for tomcat, always set this header!
 requestHeaders.set( "Accept", "application/x-www-form-urlencoded" );

 //the keycloak logout endpoint uses standard OAuth2 Basic Authentication that inclues the
 //Base64-encoded keycloak Client ID and keycloak Client Secret as the value for the Authorization header
 createBasicAuthHeaders(requestHeaders);

 //we need the keycloak refresh token in the body of the request, it can be had from the access token we got when we logged in:
 MultiValueMap&lt;String, String&gt; postParams = new LinkedMultiValueMap&lt;String, String&gt;();
 postParams.set( OAuth2Constants.REFRESH_TOKEN, accessToken.getRefreshToken().getValue() );

 HttpEntity&lt;MultiValueMap&lt;String, String&gt;&gt; requestEntity = new HttpEntity&lt;MultiValueMap&lt;String, String&gt;&gt;(postParams, requestHeaders);
 RestTemplate restTemplate = new RestTemplate();
 try {
 ResponseEntity&lt;String&gt; response = restTemplate.exchange(url, HttpMethod.POST, requestEntity, String.class);
 System.out.println(response.toString());

 } catch (HttpClientErrorException e) {
 System.out.println("We should get a 204 No Content - did we?\n" + e.getMessage()); 
 }
} 

//has a hard-coded client ID and secret, adjust accordingly
void createBasicAuthHeaders(HttpHeaders requestHeaders){
 String auth = keycloakClientId + ":" + keycloakClientSecret;
 byte[] encodedAuth = Base64.encodeBase64(
 auth.getBytes(Charset.forName("US-ASCII")) );
 String authHeaderValue = "Basic " + new String( encodedAuth );
 requestHeaders.set( "Authorization", authHeaderValue );
}
</code></pre>

blocks|key|4656071|text|在AuthServer|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4656072|@Override
public+void+configure(AuthorizationServerEndpointsConfigurer+endpoints)
++++throws+Exception+{
++...
++endpoints.addInterceptor(new+HandlerInterceptorAdapter()+{
++++@Override
++++public+void+postHandle(HttpServletRequest+request,
++++++++HttpServletResponse+response,+Object+handler,
++++++++ModelAndView+modelAndView)+throws+Exception+{
++++++if+(modelAndView+!=+null
++++++++++&&+modelAndView.getView()+instanceof+RedirectView)+{
++++++++RedirectView+redirect+=+(RedirectView)+modelAndView.getView();
++++++++String+url+=+redirect.getUrl();
++++++++if+(url.contains("code=")+%7C%7C+url.contains("error="))+{
++++++++++HttpSession+session+=+request.getSession(false);
++++++++++if+(session+!=+null)+{
++++++++++++session.invalidate();
++++++++++}
++++++++}
++++++}
++++}
++});
}|code-block|syntax|javascript|4656073|在客户端站点|4656074|.and()
.logout().logoutSuccessUrl("/").permitAll()
.and().csrf()
.ignoringAntMatchers("/login",+"/logout")
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());|4656075|对我来说似乎是个更好的解决方案。已引用此link|offset|length|4656076|entityMap|0|LINK|mutability|MUTABLE|url|https://spring.io/guides/tutorials/spring-security-and-angular-js/#_oauth2_logout_angular_js_and_spring_security_part_ix^0|0|0|0|0|K|4|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|X|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Y|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|Z|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|10|8|@]|9|@$M|11|N|12|1|13]]|A|$]]|$1|O|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V]]]]

At AuthServer 

<pre><code>@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
 throws Exception {
 ...
 endpoints.addInterceptor(new HandlerInterceptorAdapter() {
 @Override
 public void postHandle(HttpServletRequest request,
 HttpServletResponse response, Object handler,
 ModelAndView modelAndView) throws Exception {
 if (modelAndView != null
 &amp;&amp; modelAndView.getView() instanceof RedirectView) {
 RedirectView redirect = (RedirectView) modelAndView.getView();
 String url = redirect.getUrl();
 if (url.contains("code=") || url.contains("error=")) {
 HttpSession session = request.getSession(false);
 if (session != null) {
 session.invalidate();
 }
 }
 }
 }
 });
}
</code></pre>

At client site

<pre><code>.and()
.logout().logoutSuccessUrl("/").permitAll()
.and().csrf()
.ignoringAntMatchers("/login", "/logout")
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
</code></pre>

Seems a better solutions for me. referred this <a href="https://spring.io/guides/tutorials/spring-security-and-angular-js/#_oauth2_logout_angular_js_and_spring_security_part_ix" rel="nofollow noreferrer">link</a>

blocks|key|4656109|text|对于带有spring+boot+rest安全性和oauth2.0用户的注销令牌，如下所示|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4656110|import+org.springframework.security.oauth2.provider.token.ConsumerTokenServices;

@RestController
@RequestMapping("/v1/user/")
public+class+UserController+{
++++@Autowired
++++private+ConsumerTokenServices+consumerTokenServices;

++++/**
+++++*+Logout.+This+method+is+responsible+for+logout+user+from+application+based+on
+++++*+given+accessToken.
+++++*+
+++++*+@param+accessToken+the+access+token
+++++*+@return+the+response+entity
+++++*/
++++@GetMapping(value+=+"/oauth/logout")
++++public+ResponseEntity<Response>+logout(@RequestParam(name+=+"access_token")+String+accessToken)+{
++++++++consumerTokenServices.revokeToken(accessToken);
++++++++return+new+ResponseEntity<>(new+Response(messageSource.getMessage("server.message.oauth.logout.successMessage",++null,+LocaleContextHolder.getLocale())),+HttpStatus.OK);

++++}
}|code-block|syntax|javascript|4656111|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

for logout token with spring boot rest security and oauth2.0
user as follow

<pre><code>import org.springframework.security.oauth2.provider.token.ConsumerTokenServices;

@RestController
@RequestMapping("/v1/user/")
public class UserController {
 @Autowired
 private ConsumerTokenServices consumerTokenServices;

 /**
 * Logout. This method is responsible for logout user from application based on
 * given accessToken.
 * 
 * @param accessToken the access token
 * @return the response entity
 */
 @GetMapping(value = "/oauth/logout")
 public ResponseEntity&lt;Response&gt; logout(@RequestParam(name = "access_token") String accessToken) {
 consumerTokenServices.revokeToken(accessToken);
 return new ResponseEntity&lt;&gt;(new Response(messageSource.getMessage("server.message.oauth.logout.successMessage", null, LocaleContextHolder.getLocale())), HttpStatus.OK);

 }
}
</code></pre>

When I want to get logout I invoke this code:

<pre><code>request.getSession().invalidate();
SecurityContextHolder.getContext().setAuthentication(null);
</code></pre>

But after it (in next request using old oauth token) I invoke 

<code>SecurityContextHolder.getContext().getAuthentication();</code>

and I see my old user there.

How to fix it?

Spring security. How to log out user (revoke oauth2 token)

服务器

OAuth

当我想要注销时，我调用以下代码：request.getSession().invalidate();SecurityContextHolder.getContext().setAuthentication(null);但在此之后(在使用旧oauth令牌的下一个请求中)，我调用SecurityContextHolder....

问Spring security。如何注销用户(撤销oauth2令牌)
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Spring security。如何注销用户(撤销oauth2令牌)EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Spring security。如何注销用户(撤销oauth2令牌)
EN