Question

I am new to Spring Web MVC..

Can I get some example or online link that shows me how to implement logout feature using spring web mvc ?

I don’t want to use the in built feature of spring security (i.e. ACEGI)..

Thanks in advance…

Answer 1

The trick with the session invalidation doesn’t work. It seems the Spring authentication buffers the session ID somewhere and accept the COOKIE even, if the session was invalidated.

Another solution is to clear the Spring security context manually:

public void manualLogout() {
    SecurityContextHolder.getContext().setAuthentication(null);
}

Here is the code, how to log in user manually (if somebody needs):

public void doManualLogin(HttpServletRequest request, String u, String p) {
    UsernamePasswordAuthenticationToken token = 
            new UsernamePasswordAuthenticationToken(u, p);
    token.setDetails(new WebAuthenticationDetails(request));
    Authentication auth = authenticationProvider.authenticate(token);
    SecurityContextHolder.getContext().setAuthentication(auth);
}

where the authenticationProvider is the bean from you spring configuration which implements

org.springframework.security.authentication.AuthenticationProvider