Spring Security Logout (example of spring security login)

* * Spring Security Logout (example of Spring Security show)

**
In learning to implement spring security logout of the time found a foreign language, feeling written very good, here ventured to try to translate it, the original link: http://websystique.com/spring-security/ spring-security-4-logout-example/

Translate as follows:
This article shows how to implement the Spring security user logout operation by encoding. A back key via the browser will also trigger logout.
In general, it is necessary to provide the user with a logout link in your page, as shown in the following code:

<%@ page language= "java" contenttype= "text/html; Charset=iso-8859-1 "pageencoding=" iso-8859-1 "%>
<%@ taglib prefix=" C "uri=" http://java.sun.com/jsp/jstl/ Core "%>
 
Note: The JSTL tag is used in the code, and if you want to use the above code, you need to import the Jstl jar package into your project.

There's no special place. Now you only need to mark out the logout method in the SPRINGMVC controller. Create a new method with the following code:

@RequestMapping (value= "/logout", method = requestmethod.get) public
String Logoutpage (httpservletrequest request , httpservletresponse response) {
    Authentication auth = Securitycontextholder.getcontext (). Getauthentication ();
    if (auth! = null) {    
        new Securitycontextlogouthandler (). Logout (Request, response, auth);
    }
    return "Redirect:/login?logout";//you can redirect wherever you want, but generally it's a good practice to show login SCR Een again.
}
 
(logical parsing of the above code) we first determine whether the user clicks the logout link when it is verified (this may be the user's session failure, etc.).
Securitycontextholder.getcontext (). Getauthentication ()
If the above code gets a authentication object that is not empty, then we call the
Securitycontextlogouthandler (). Logout (Request, response, Auth)
To log out of the user.
The logout operation requires the following steps: Invalidate the HTTP session and then unbind the bound object on the session. Remove the user's authentication information from the securitycontext of spring security to prevent the problem of concurrent requests.

Clears the associated property value completely from the current thread.

It's done by now.