Spring Security源碼分析八：Spring Security 退出

Spring Security是一個可以爲基於Spring的企業應用系統提供聲明式的安全訪問控制解決方案的安全框架。它提供了一組能夠在Spring應用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反轉Inversion of Control ,DI:Dependency Injection 依賴注入）和AOP（面向切面編程）功能，爲應用系統提供聲明式的安全訪問控制功能，減小了爲企業系統安全控制編寫大量重複代碼的工做。

退出原理

1. 清除Cookie
2. 清除當前用戶的remember-me記錄
3. 使當前session失效
4. 清空當前的SecurityContext
5. 重定向到登陸界面

Spring Security的退出請求（默認爲/logout）由LogoutFilter過濾器攔截處理。

退出的實現

1. 主頁中添加退出連接

<a href="/signOut">退出</a>
複製代碼

2. 配置MerryyouSecurityConfig

......
				.and()
                .logout()
                .logoutUrl("/signOut")//自定義退出的地址
                .logoutSuccessUrl("/register")//退出以後跳轉到註冊頁面
                .deleteCookies("JSESSIONID")//刪除當前的JSESSIONID
                .and()
......
複製代碼

效果以下

https://user-gold-cdn.xitu.io/2018/1/18/16108afa77d2051e?w=1012&h=651&f=gif&s=1286199

源碼分析

LogoutFilter#doFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		//#1.匹配到/logout請求
		if (requiresLogout(request, response)) {
			Authentication auth = SecurityContextHolder.getContext().getAuthentication();

			if (logger.isDebugEnabled()) {
				logger.debug("Logging out user '" + auth
						+ "' and transferring to logout destination");
			}
			//#2.處理1-4步
			this.handler.logout(request, response, auth);
			//#3.重定向到註冊界面
			logoutSuccessHandler.onLogoutSuccess(request, response, auth);

			return;
		}

		chain.doFilter(request, response);
	}
複製代碼

1. 匹配當前攔截的請求
2. 處理 清空Cookie、remember-me、session和SecurityContext
3. 重定向到登陸界面

handler

https://user-gold-cdn.xitu.io/2018/1/18/16108afa7517f33a?w=608&h=337&f=png&s=45158

1. CookieClearingLogoutHandler清空Cookie
2. PersistentTokenBasedRememberMeServices清空remember-me
3. SecurityContextLogoutHandler 使當前session無效,清空當前的SecurityContext

CookieClearingLogoutHandler#logout

public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
		for (String cookieName : cookiesToClear) {
			//# 1.Cookie置爲null
			Cookie cookie = new Cookie(cookieName, null);
			String cookiePath = request.getContextPath();
			if (!StringUtils.hasLength(cookiePath)) {
				cookiePath = "/";
			}
			cookie.setPath(cookiePath);
			cookie.setMaxAge(0);
			response.addCookie(cookie);
		}
	}
複製代碼

1. Cookie置爲null

PersistentTokenBasedRememberMeServices#logout

public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
		super.logout(request, response, authentication);

		if (authentication != null) {
			//#1.清空persistent_logins表中記錄
			tokenRepository.removeUserTokens(authentication.getName());
		}
	}
複製代碼

1. 清空persistent_logins表中記錄

SecurityContextLogoutHandler#logout

public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
		Assert.notNull(request, "HttpServletRequest required");
		if (invalidateHttpSession) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				logger.debug("Invalidating session: " + session.getId());
				//#1.使當前session失效
				session.invalidate();
			}
		}

		if (clearAuthentication) {
			SecurityContext context = SecurityContextHolder.getContext();
			//#2.清空當前的`SecurityContext`
			context.setAuthentication(null);
		}

		SecurityContextHolder.clearContext();
	}
複製代碼

1. 使當前session失效
2. 清空當前的SecurityContext

AbstractAuthenticationTargetUrlRequestHandler#handle

protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
		//#1.獲取配置的跳轉地址
		String targetUrl = determineTargetUrl(request, response);

		if (response.isCommitted()) {
			logger.debug("Response has already been committed. Unable to redirect to "
					+ targetUrl);
			return;
		}
		//#2.跳轉請求
		redirectStrategy.sendRedirect(request, response, targetUrl);
	}
複製代碼

1. 獲取配置的跳轉地址
2. 跳轉請求

代碼下載

從個人 github 中下載，github.com/longfeizhen…