From 0734d70d0246228d9665173b96a4901bcc07a1a3 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Sat, 28 Oct 2017 23:35:17 -0500 Subject: [PATCH] Logout requires POST Issue: gh-4734 --- .../config/web/server/ServerHttpSecurity.java | 39 ++++++------------- .../logout/LogoutWebFilter.java | 3 +- 2 files changed, 13 insertions(+), 29 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java index e9d5a6a9a0..93aa7f4e85 100644 --- a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java +++ b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java @@ -641,31 +641,26 @@ public class ServerHttpSecurity { * @since 5.0 */ public final class LogoutBuilder { - - private ServerLogoutHandler serverLogoutHandler = new SecurityContextServerLogoutHandler(); - - private ServerLogoutSuccessHandler logoutSuccessHandler; - - private String logoutUrl = "/logout"; - - private ServerWebExchangeMatcher requiresLogout = ServerWebExchangeMatchers - .pathMatchers(this.logoutUrl); + private LogoutWebFilter logoutWebFilter = new LogoutWebFilter(); public LogoutBuilder logoutHandler(ServerLogoutHandler serverLogoutHandler) { - Assert.notNull(serverLogoutHandler, "logoutHandler must not be null"); - this.serverLogoutHandler = serverLogoutHandler; + this.logoutWebFilter.setServerLogoutHandler(serverLogoutHandler); return this; } public LogoutBuilder logoutUrl(String logoutUrl) { - Assert.notNull(this.serverLogoutHandler, "logoutUrl must not be null"); - this.logoutUrl = logoutUrl; - this.requiresLogout = ServerWebExchangeMatchers.pathMatchers(logoutUrl); + Assert.notNull(logoutUrl, "logoutUrl must not be null"); + ServerWebExchangeMatcher requiresLogout = ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, logoutUrl); + return requiresLogout(requiresLogout); + } + + public LogoutBuilder requiresLogout(ServerWebExchangeMatcher requiresLogout) { + this.logoutWebFilter.setRequiresLogout(requiresLogout); return this; } public LogoutBuilder logoutSuccessHandler(ServerLogoutSuccessHandler handler) { - this.logoutSuccessHandler = handler; + this.logoutWebFilter.setServerLogoutSuccessHandler(handler); return this; } @@ -679,19 +674,7 @@ public class ServerHttpSecurity { } public void configure(ServerHttpSecurity http) { - LogoutWebFilter logoutWebFilter = createLogoutWebFilter(http); - http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT); - } - - private LogoutWebFilter createLogoutWebFilter(ServerHttpSecurity http) { - LogoutWebFilter logoutWebFilter = new LogoutWebFilter(); - logoutWebFilter.setServerLogoutHandler(this.serverLogoutHandler); - logoutWebFilter.setRequiresLogout(this.requiresLogout); - if(this.logoutSuccessHandler != null) { - logoutWebFilter.setServerLogoutSuccessHandler(this.logoutSuccessHandler); - } - - return logoutWebFilter; + http.addFilterAt(this.logoutWebFilter, SecurityWebFiltersOrder.LOGOUT); } private LogoutBuilder() {} diff --git a/web/src/main/java/org/springframework/security/web/server/authentication/logout/LogoutWebFilter.java b/web/src/main/java/org/springframework/security/web/server/authentication/logout/LogoutWebFilter.java index 1ae8d2711b..e414cba6a9 100644 --- a/web/src/main/java/org/springframework/security/web/server/authentication/logout/LogoutWebFilter.java +++ b/web/src/main/java/org/springframework/security/web/server/authentication/logout/LogoutWebFilter.java @@ -16,6 +16,7 @@ package org.springframework.security.web.server.authentication.logout; +import org.springframework.http.HttpMethod; import org.springframework.security.core.context.ReactiveSecurityContextHolder; import org.springframework.util.Assert; import reactor.core.publisher.Mono; @@ -46,7 +47,7 @@ public class LogoutWebFilter implements WebFilter { private ServerLogoutSuccessHandler serverLogoutSuccessHandler = new RedirectServerLogoutSuccessHandler(); private ServerWebExchangeMatcher requiresLogout = ServerWebExchangeMatchers - .pathMatchers("/logout"); + .pathMatchers(HttpMethod.POST, "/logout"); @Override public Mono filter(ServerWebExchange exchange, WebFilterChain chain) {