Java LogoutFilter类代码示例

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
  AuthenticationEntryPoint authenticationEntryPoint = lookup("authenticationEntryPoint");

  http.csrf().disable()
      .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
      .and()
      .sessionManagement().sessionCreationPolicy(STATELESS);

  customizeRequestAuthorization(http.authorizeRequests()
      .antMatchers("/").permitAll()
      .antMatchers(POST, LOGIN_ENDPOINT).permitAll()
      .and());

  http.authorizeRequests().anyRequest().authenticated();

  JwtTokenService jwtTokenService = lookup("jwtTokenService");

  // JwtAuthenticationFilter must precede LogoutFilter, otherwise LogoutHandler wouldn't know who
  // logs out.
  customizeFilters(
      http.addFilterBefore(new JwtAuthenticationFilter(jwtTokenService), LogoutFilter.class));

  customizeRememberMe(http);
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
  //解决Refused to display 'http://......' in a frame because it set 'X-Frame-Options' to 'DENY'. "错误
  http.headers().frameOptions().disable();

  http.authorizeRequests().antMatchers("/").permitAll()
          .antMatchers("/**/session/**").authenticated()//登录即可获取session信息
          // 其他地址的访问均需验证权限（需要登录，且有指定的权限）
          .anyRequest().access("@permissionService.hasPermission(request,authentication)").and()
          .addFilterBefore(corsFilter,UsernamePasswordAuthenticationFilter.class)
          .addFilterAt(codeUsernamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class).exceptionHandling()
          .authenticationEntryPoint((request, response, authException) -> {
            String result = JSON.toJSONString(JsonUtil.getResultJson(ResultCodeEnum.NOLOGIN));
            HttpHelper.setResponseJsonData(response,result);
          }).and()
          .addFilterBefore(corsFilter,LogoutFilter.class)
          .formLogin().loginProcessingUrl("/login").permitAll().and()
          .logout().logoutSuccessHandler(logoutSuccessHandler()).permitAll();
  http.csrf().disable();
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
/**
 * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity)
 */
@Override
protected void configure(HttpSecurity http) throws Exception {
	http.exceptionHandling()
			.authenticationEntryPoint(casEntryPoint())
			.and()
		.authorizeRequests()
			.antMatchers(ConstanteUtils.SECURITY_CONNECT_PATH+"/**").authenticated()
			.antMatchers("/**").permitAll()
			.antMatchers(ConstanteUtils.SECURITY_SWITCH_PATH).hasAuthority(NomenclatureUtils.DROIT_PROFIL_ADMIN)
			.antMatchers(ConstanteUtils.SECURITY_SWITCH_BACK_PATH).hasAuthority(SwitchUserFilter.ROLE_PREVIOUS_ADMINISTRATOR)
			.anyRequest().authenticated()
			.and()
		.addFilterBefore(singleSignOutFilter(), LogoutFilter.class)
		.addFilter(new LogoutFilter(casUrl + ConstanteUtils.SECURITY_LOGOUT_PATH, new SecurityContextLogoutHandler()))
		.addFilter(casAuthenticationFilter())
		.addFilterAfter(switchUserFilter(), FilterSecurityInterceptor.class)
		/* La protection Spring Security contre le Cross Scripting Request Forgery est désactivée, Vaadin implémente sa propre protection */
		.csrf().disable()
		.headers()
			/* Autorise l'affichage en iFrame */
			.frameOptions().disable()
			/* Supprime la gestion du cache du navigateur, pour corriger le bug IE de chargement des polices cf. http://stackoverflow.com/questions/7748140/font-face-eot-not-loading-over-https */
			.cacheControl().disable();
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests() // 配置安全策略
                .antMatchers("/", "/index").permitAll() // 定义首页请求不需要验证
                .anyRequest().authenticated() // 其余的所有请求都需要验证
                .and()
                .logout()
                .permitAll() // 定义logout不需要验证
                .and()
                .formLogin(); // 使用form表单登录

        http.exceptionHandling().authenticationEntryPoint(casAuthenticationEntryPoint())
                .and()
                .addFilter(casAuthenticationFilter())
                .addFilterBefore(requestSingleLogoutFilter(), LogoutFilter.class)
                .addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class);

//        http.csrf().disable(); // 禁用CSRF
    }
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Test
@SuppressWarnings("unchecked")
public void Can_add_a_logout_handler() {

    final LogoutFilter filter = mock(LogoutFilter.class);

    final CaptureHandlers handlers = new CaptureHandlers();

    // Given
    willAnswer(handlers).given(mutator).update(eq(filter), eq("handlers"), eq(List.class), any(Updater.class));

    // When
    logoutHandlerAdder.modify(filter);

    // Then
    assertThat(handlers, contains((LogoutHandler) logoutHandler));
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
	http.addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class).exceptionHandling()
			.authenticationEntryPoint(casAuthenticationEntryPoint()).and().addFilter(casAuthenticationFilter())
			.addFilterBefore(singleSignOutFilter(), CasAuthenticationFilter.class)
			.addFilterBefore(requestCasGlobalLogoutFilter(), LogoutFilter.class);

	http.headers().frameOptions().disable().authorizeRequests().antMatchers("/").permitAll()
			.antMatchers("/login", "/logout", "/secure").authenticated().antMatchers("/filtered")
			.hasAuthority(AuthoritiesConstants.ADMIN).anyRequest().authenticated();

	/**
	 * <logout invalidate-session="true" delete-cookies="JSESSIONID" />
	 */
	http.logout().logoutUrl("/logout").logoutSuccessUrl("/").invalidateHttpSession(true)
			.deleteCookies("JSESSIONID");

	// http.csrf();
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
public void configure(HttpSecurity http) throws Exception {
    http.logout()
        .permitAll()
        .logoutSuccessUrl("/logout.html")
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
    String logoutUrl = UriComponentsBuilder
            .fromUri(casSecurityProperties.getServer().getBaseUrl())
            .path(casSecurityProperties.getServer().getPaths().getLogout())
            .toUriString();
    LogoutFilter filter = new LogoutFilter(logoutUrl, new SecurityContextLogoutHandler());
    filter.setFilterProcessesUrl("/cas/logout");
    http.addFilterBefore(filter, LogoutFilter.class);
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
/**
 * Request single point exit filter
 */
@Bean
public LogoutFilter casLogoutFilter() {
    LogoutFilter logoutFilter = new LogoutFilter(
            casServerLogout,
            new SecurityContextLogoutHandler());
    logoutFilter.setFilterProcessesUrl("/logout");
    return logoutFilter;
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
/**
 * Create a simple filter that allows logout on a REST Url /services/rest/logout and returns a simple HTTP status 200
 * ok.
 *
 * @return the filter.
 */
protected Filter getSimpleRestLogoutFilter() {

  LogoutFilter logoutFilter =
      new LogoutFilter(new LogoutSuccessHandlerReturningOkHttpStatusCode(), new SecurityContextLogoutHandler());

  // configure logout for rest logouts
  logoutFilter.setLogoutRequestMatcher(new AntPathRequestMatcher("/services/rest/logout"));

  return logoutFilter;
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
/**
 * 请求单点退出过滤器
 */
@Bean
public LogoutFilter requestSingleLogoutFilter() {
    LogoutFilter logoutFilter = new LogoutFilter(casProperties.getCasServerLogoutUrl(), new SecurityContextLogoutHandler());
    logoutFilter.setFilterProcessesUrl(casProperties.getAppLogoutUrl());
    return logoutFilter;
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@SuppressWarnings("unchecked")
@Override
public void modify(final LogoutFilter filter) {
    mutator.update(filter, "handlers", List.class, new Updater<List>() {
        @Override
        public List update(List oldHandlers) {
            final List<LogoutHandler> handlers = new ArrayList<>(oldHandlers);
            handlers.add(0, logoutHandler);
            return asList(handlers.toArray(new LogoutHandler[handlers.size()]));
        }
    });
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Test
public void Can_weave_a_security_filter_chain() {

    // Given
    final SecurityFilterChain filterChain = mock(SecurityFilterChain.class);

    // When
    chainWeaver.weave(filterChain);

    // Then
    verify(modifier).modifyLink(filterChain, LogoutFilter.class, logoutHandlerAdder);
    verify(modifier).addBefore(filterChain, UsernamePasswordAuthenticationFilter.class, authenticationFilter);
    verify(modifier).modifyLink(filterChain, UsernamePasswordAuthenticationFilter.class, successHandlerWrapper);
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
@Override
public void configureHttpSecurity(HttpSecurity http) throws Exception {
	http.formLogin().disable();
	
	http
		.sessionManagement().sessionAuthenticationStrategy(sessionAuthenticationStrategy())
		.and()
		.addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
		.addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class)
		.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
		.and()
		.logout().addLogoutHandler(keycloakLogoutHandler());
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
/**
 * Defines the web based security configuration.
 *
 * @param http It allows configuring web based security for specific http requests.
 */
@Override
protected void configure(HttpSecurity http) throws Exception {
    HttpSessionSecurityContextRepository securityContextRepository = new HttpSessionSecurityContextRepository();
    securityContextRepository.setSpringSecurityContextKey("SPRING_SECURITY_CONTEXT_SAML");
    http
            .securityContext()
            .securityContextRepository(securityContextRepository);
    http
            .httpBasic()
            .disable();
    http
            .csrf()
            .disable();
    http
            .addFilterAfter(metadataGeneratorFilter, BasicAuthenticationFilter.class)
            .addFilterAfter(metadataDisplayFilter, MetadataGeneratorFilter.class)
            .addFilterAfter(samlEntryPoint, MetadataDisplayFilter.class)
            .addFilterAfter(samlWebSSOProcessingFilter, SAMLEntryPoint.class)
            .addFilterAfter(samlWebSSOHoKProcessingFilter, SAMLProcessingFilter.class)
            .addFilterAfter(samlLogoutProcessingFilter, SAMLWebSSOHoKProcessingFilter.class)
            .addFilterAfter(samlIDPDiscovery, SAMLLogoutProcessingFilter.class)
            .addFilterAfter(samlLogoutFilter, LogoutFilter.class);
    http
            .authorizeRequests()
            .antMatchers("/", "/error", "/saml/**", "/idpselection").permitAll()
            .anyRequest().authenticated();
    http
            .exceptionHandling()
            .authenticationEntryPoint(samlEntryPoint);
    http
            .logout()
            .disable();
}
 

import org.springframework.security.web.authentication.logout.LogoutFilter; //导入依赖的package包/类
private void addLogoutFilter(List<Filter> filters, MotechURLSecurityRule securityRule) {
    if (securityRule.isRest()) {
        return;
    }

    LogoutHandler springLogoutHandler = new SecurityContextLogoutHandler();
    LogoutFilter logoutFilter = new LogoutFilter("/module/server/login", motechLogoutHandler, springLogoutHandler);
    logoutFilter.setFilterProcessesUrl("/module/server/j_spring_security_logout");
    filters.add(logoutFilter);
}