Question

我有以下JSF页面：

<h:form>
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    <b:navBar brand="TEST" brandHref="#" inverse="true">

        <p:lightBox styleClass="menucolored">

            <p:commandLink id="logout"
                           type="button"
                           action="/j_spring_security_logout"
                           value="Log Out" ajax="false"
                           styleClass="menucolored"/>
        </p:lightBox>
    </b:navBar>
</h:form>

Spring Security xml：

<http use-expressions="true" auto-config="true">
    <form-login login-page="/pages/Login.xhtml"
                login-processing-url="/j_spring_security_check"
                authentication-failure-url="/loginPage?error=1"
                default-target-url="/pages/Home.xhtml"
                always-use-default-target="true"
                username-parameter="j_username"
                password-parameter="j_password"/>

    <!-- On logout success load the login page -->
    <logout logout-success-url="/pages/Login.xhtml" />

    <!-- enable csrf protection -->
    <csrf />
</http>

Web.xml中

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
</filter-mapping>

我尝试用

替换命令链接

<h:outputLink value="${request.contextPath}/j_spring_security_logout">logout</h:outputLink>

或

<h:outputLink value="${pageContext.request.contextPath}/j_spring_security_logout">logout</h:outputLink>

仍然没有运气。当我点击按钮时没有任何反应。

Answer 1

如果启用了CSRF，则必须logout with a POST method。您需要将其包装在标准HTML表单中：

<form action="${request.contextPath}/j_spring_security_logout" method="post">
  <input type="submit" value="Log out" />
  <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>

要使用链接而不是按钮，您需要编写一些javascript才能使链接提交表单。请参阅this post。

Answer 2

我修好了它：

public String doLogout() throws ServletException, IOException {
    System.out.println("In doLogout()");
    ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();

    RequestDispatcher dispatcher = ((ServletRequest) context.getRequest())
            .getRequestDispatcher("/logout");

    dispatcher.forward((ServletRequest) context.getRequest(),
            (ServletResponse) context.getResponse());

    FacesContext.getCurrentInstance().responseComplete();
    System.out.println("End doLogout()");
    return null;
}

我必须使用/logout而不是/j_spring_security_logout

Answer 3

您可以将此javascript解决方案用于Spring Security 4 + CSRF + JSF：

<a href="#" onclick="document.getElementById('logout').submit();">Logout</a>
 <form action="logout" id="logout" method="post">                           
   <input type="hidden" name="${_csrf.parameterName}" 
   value="${_csrf.token}" />
</form>

Spring Logout无法正常工作和重定向

3 个答案: