⒈如何退出登錄？
SpringSecurity默認為我們提供了退出操作，我們只需要訪問特定的url就可以退出登錄了
1 <!DOCTYPE html> 2 <html lang="en"> 3 <head> 4 <meta charset="UTF-8"> 5 <title>退出登錄</title> 6 </head> 7 <body> 8 <a href="/logout">退出登錄</a> 9 </body> 10 </html>
⒉SpringSecurity默認為我們做了什么？
1.使當前Session失效
2.清除與當前用戶相關的remember-me記錄
3.清空當前的SecurityContext
4.重定向到登陸頁面
⒊我們如何自定義退出登錄
1 package cn.coreqi.security.config; 2 3 import cn.coreqi.security.Filter.SmsCodeFilter; 4 import cn.coreqi.security.Filter.ValidateCodeFilter; 5 import cn.coreqi.security.handler.CoreqiLogoutSuccessHandler; 6 import org.springframework.beans.factory.annotation.Autowired; 7 import org.springframework.context.annotation.Bean; 8 import org.springframework.context.annotation.Configuration; 9 import org.springframework.security.config.annotation.web.builders.HttpSecurity; 10 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; 11 import org.springframework.security.crypto.password.NoOpPasswordEncoder; 12 import org.springframework.security.crypto.password.PasswordEncoder; 13 import org.springframework.security.web.authentication.AuthenticationFailureHandler; 14 import org.springframework.security.web.authentication.AuthenticationSuccessHandler; 15 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; 16 17 @Configuration 18 public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 19 20 @Autowired 21 private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler; 22 23 @Autowired 24 private AuthenticationFailureHandler coreqiAuthenticationFailureHandler; 25 26 @Autowired 27 private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig; 28 29 @Bean 30 public PasswordEncoder passwordEncoder(){ 31 return NoOpPasswordEncoder.getInstance(); 32 } 33 34 35 @Override 36 protected void configure(HttpSecurity http) throws Exception { 37 ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter(); 38 validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler); 39 40 SmsCodeFilter smsCodeFilter = new SmsCodeFilter(); 41 42 43 //http.httpBasic() //httpBasic登錄 BasicAuthenticationFilter 44 http.addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class) //加載用戶名密碼過濾器的前面 45 .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class) //加載用戶名密碼過濾器的前面 46 .formLogin() //表單登錄 UsernamePasswordAuthenticationFilter 47 .loginPage("/coreqi-signIn.html") //指定登錄頁面 48 //.loginPage("/authentication/require") 49 .loginProcessingUrl("/authentication/form") //指定表單提交的地址用於替換UsernamePasswordAuthenticationFilter默認的提交地址 50 .successHandler(coreqiAuthenticationSuccessHandler) //登錄成功以后要用我們自定義的登錄成功處理器，不用Spring默認的。 51 .failureHandler(coreqiAuthenticationFailureHandler) //自己體會把 52 .and() 53 .logout() //退出登錄相關配置 54 .logoutUrl("signOut") //自定義退出登錄頁面 55 .logoutSuccessHandler(new CoreqiLogoutSuccessHandler()) //退出成功后要做的操作（如記錄日志），和logoutSuccessUrl互斥 56 //.logoutSuccessUrl("/index") //退出成功后跳轉的頁面 57 .deleteCookies("JSESSIONID") //退出時要刪除的Cookies的名字 58 .and() 59 .authorizeRequests() //對授權請求進行配置 60 .antMatchers("/coreqi-signIn.html","/code/image","/session/invalid").permitAll() //指定登錄頁面不需要身份認證 61 .anyRequest().authenticated() //任何請求都需要身份認證 62 .and().csrf().disable() //禁用CSRF 63 .apply(smsCodeAuthenticationSecurityConfig); 64 //FilterSecurityInterceptor 整個SpringSecurity過濾器鏈的最后一環 65 } 66 }