Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

退出原理

1. 清除Cookie
2. 清除当前用户的remember-me记录
3. 使当前session失效
4. 清空当前的SecurityContext
5. 重定向到登录界面

Spring Security的退出请求（默认为/logout）由LogoutFilter过滤器拦截处理。

退出的实现

1. 主页中添加退出链接

<a href="/signOut">退出</a>

1. 配置MerryyouSecurityConfig

.......and().logout().logoutUrl("/signOut")//自定义退出的地址.logoutSuccessUrl("/register")//退出之后跳转到注册页面.deleteCookies("JSESSIONID")//删除当前的JSESSIONID.and()
......

效果如下

源码分析

LogoutFilter#doFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) req;HttpServletResponse response = (HttpServletResponse) res;//#1.匹配到/logout请求if (requiresLogout(request, response)) {Authentication auth = SecurityContextHolder.getContext().getAuthentication();if (logger.isDebugEnabled()) {logger.debug("Logging out user '" + auth+ "' and transferring to logout destination");}//#2.处理1-4步this.handler.logout(request, response, auth);//#3.重定向到注册界面logoutSuccessHandler.onLogoutSuccess(request, response, auth);return;}chain.doFilter(request, response);}

1. 匹配当前拦截的请求
2. 处理 清空Cookie、remember-me、session和SecurityContext
3. 重定向到登录界面

handler

1. CookieClearingLogoutHandler清空Cookie
2. PersistentTokenBasedRememberMeServices清空remember-me
3. SecurityContextLogoutHandler 使当前session无效,清空当前的SecurityContext

CookieClearingLogoutHandler#logout

public void logout(HttpServletRequest request, HttpServletResponse response,Authentication authentication) {for (String cookieName : cookiesToClear) {//# 1.Cookie置为nullCookie cookie = new Cookie(cookieName, null);String cookiePath = request.getContextPath();if (!StringUtils.hasLength(cookiePath)) {cookiePath = "/";}cookie.setPath(cookiePath);cookie.setMaxAge(0);response.addCookie(cookie);}}

1. Cookie置为null

PersistentTokenBasedRememberMeServices#logout

public void logout(HttpServletRequest request, HttpServletResponse response,Authentication authentication) {super.logout(request, response, authentication);if (authentication != null) {//#1.清空persistent_logins表中记录tokenRepository.removeUserTokens(authentication.getName());}}

1. 清空persistent_logins表中记录

SecurityContextLogoutHandler#logout

public void logout(HttpServletRequest request, HttpServletResponse response,Authentication authentication) {Assert.notNull(request, "HttpServletRequest required");if (invalidateHttpSession) {HttpSession session = request.getSession(false);if (session != null) {logger.debug("Invalidating session: " + session.getId());//#1.使当前session失效session.invalidate();}}if (clearAuthentication) {SecurityContext context = SecurityContextHolder.getContext();//#2.清空当前的`SecurityContext`context.setAuthentication(null);}SecurityContextHolder.clearContext();}

1. 使当前session失效
2. 清空当前的SecurityContext

AbstractAuthenticationTargetUrlRequestHandler#handle

 protected void handle(HttpServletRequest request, HttpServletResponse response,Authentication authentication) throws IOException, ServletException {//#1.获取配置的跳转地址String targetUrl = determineTargetUrl(request, response);if (response.isCommitted()) {logger.debug("Response has already been committed. Unable to redirect to "+ targetUrl);return;}//#2.跳转请求redirectStrategy.sendRedirect(request, response, targetUrl);}

1. 获取配置的跳转地址
2. 跳转请求

代码下载

从我的 github 中下载，https://github.com/longfeizheng/logback