Spring安全和自定義記得我過濾器：註銷問題

Question

我需要定義一個自定義的RememberMeAuthenticationFilter，以便我可以覆蓋onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult)方法來放置一些自定義邏輯。

我已經配置了XML才能使用我的自定義過濾器：

<security:http disable-url-rewriting="true" request-matcher-ref="excludeUrlRequestMatcher" entry-point-ref="authenticationEntryPoint"> 
    <security:custom-filter position="FORM_LOGIN_FILTER" ref="usernamePasswordAuthenticationFilter"/> 
    <security:custom-filter position="REMEMBER_ME_FILTER" ref="extRememberMeProcessingFilter"/> 

    <security:anonymous username="anonymous" granted-authority="ROLE_ANONYMOUS"/> 

    <security:session-management session-authentication-strategy-ref="fixation" /> 

    <!-- Intercepts url HERE: removed for brevity --> 

    <!--<security:form-login: using custom filter --> 
      <!--login-page="/login"--> 
      <!--authentication-failure-handler-ref="loginAuthenticationFailureHandler"--> 
      <!--authentication-success-handler-ref="loginGuidAuthenticationSuccessHandler"/>--> 


    <security:logout logout-url="/logout" success-handler-ref="logoutSuccessHandler"/> 

    <security:port-mappings> 
     <security:port-mapping http="#{configurationService.configuration.getProperty('tomcat.http.port')}" 
           https="#{configurationService.configuration.getProperty('tomcat.ssl.port')}"/> 
     <security:port-mapping http="80" https="443"/> 
     <!--security:port-mapping http="#{configurationService.configuration.getProperty('proxy.http.port')}" 
      https="#{configurationService.configuration.getProperty('proxy.ssl.port')}" /--> 
    </security:port-mappings> 

    <security:request-cache ref="httpSessionRequestCache"/> 

    <security:access-denied-handler ref="b2bAccessDeniedHandler"/> 

    <!-- RememberMe: using custom filter --> 
    <!--<security:remember-me key="comtestrememberme" services-ref="rememberMeServices"/>--> 

</security:http> 

<security:authentication-manager alias="authenticationManager"> 
    <security:authentication-provider ref="myAuthenticationProvider"/> 
    <security:authentication-provider ref="rememberMeAuthenticationProvider"/> 
</security:authentication-manager> 

<bean id="myAuthenticationProvider" 
     class="com.test.security.MyAuthenticationProvider"> 
    <property name="bruteForceAttackCounter" ref="bruteForceAttackCounter"/> 
    <property name="customerService" ref="customerService"/> 
    <aop:scoped-proxy/> 
</bean> 

<bean id="rememberMeServices" 
     class="com.test.security.MyRememberMeServices"> 
    <property name="key" value="comtestrememberme"/> 
    <property name="cookieName" value="myRememberMe"/> 
    <property name="alwaysRemember" value="false"/> 
    <property name="customerService" ref="customerService"/> 
    <property name="useSecureCookie" value="false"/> 
    <aop:scoped-proxy/> 
</bean> 

<bean id="rememberMeAuthenticationProvider" 
     class="org.springframework.security.authentication.RememberMeAuthenticationProvider"> 
    <property name="key" value="comtestrememberme"/> 
    <aop:scoped-proxy/> 
</bean> 

<bean id="usernamePasswordAuthenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> 
    <property name="authenticationManager" ref="authenticationManager"/> 
    <property name="filterProcessesUrl" value="/j_spring_security_check"/> 
    <property name="rememberMeServices" ref="rememberMeServices"/> 
    <property name="authenticationSuccessHandler" ref="loginGuidAuthenticationSuccessHandler"/> 
    <property name="authenticationFailureHandler" ref="loginAuthenticationFailureHandler"/> 
</bean> 

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> 
    <property name="loginFormUrl" value="/login"/> 
</bean> 

<bean id="extRememberMeProcessingFilter" class="com.test.security.filters.ExtRememberMeAuthenticationFilter"> 
    <property name="rememberMeServices" ref="rememberMeServices"/> 
    <property name="authenticationManager" ref="authenticationManager"/> 
</bean> 

記住我是越來越創建的cookie和正在使用我的自定義過濾器，但問題是，註銷從未發生過。

當我點擊註銷按鈕時，它看起來像我正在通過身份驗證過程再次，客戶再次登錄。

如果我恢復到標準的Spring過濾器，一切工作正常。

我錯過了配置中的某些東西嗎？

Answer 1

這裏可能發生了什麼 - 您的註銷工作正常，但您尚未在註銷時刪除myRememberMe cookie。因此，當您的會話在註銷時失效時，請記住我的服務正在使用myRememberMe cookie創建新會話。

解決方案：您可以通過在<security:logout>標記中添加delete-cookies屬性來修改配置。