How can i logout successfully with spring security using FreeMarker

[Jhon Parker]

I'm having problems trying to logout from my application, when I press the logout button in my application it shows me the login page again, but if write in the search bar in my browser I can go to any page in my application without having to login again, it seems that when I press the logout link I don't logout at all.

here are my mave dependencies

<!-- SPRING SECURITY -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>3.2.5.RELEASE</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>3.2.4.RELEASE</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-taglibs</artifactId>
        <version>4.0.0.RELEASE</version>
    </dependency>

I'm using FreeMarkes as my template engine and I use this expression to have access to Jsp Security Tags.

<#assign security=JspTaglibs["http://www.springframework.org/security/tags"] />

here is my login controller:

@Controller
@RequestMapping("/login/")

public class LoginControl {



@RequestMapping (value = "login", method = RequestMethod.GET)
public String login (Model model, @RequestParam(value = "logout", required = false) String logout) 
{

    System.out.println(" logut is " + logout);
    return "/login/login";
}
}

And here is my spring security configuration, I'm using a java configuration and no XML

@Configuration
@EnableWebMvcSecurity
public class SeguridadConfiguracion extends WebSecurityConfigurerAdapter {



@Autowired 
private AutrProvider aut;



@Override
protected void configure( HttpSecurity http ) throws Exception 
{
    http
        .authenticationProvider(autenticador)
        .authorizeRequests()
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/css/**").permitAll() 
            .antMatchers("/js/**").permitAll()
            .antMatchers("/img/**").permitAll() 
            .antMatchers("/sound/**").permitAll() 
            .antMatchers("/fonts/**").permitAll()
            .antMatchers("/ajax/**").permitAll()
            .antMatchers("/php/**").permitAll()
            .antMatchers("/xml/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
                .loginPage("/login/login")
                .permitAll()
                .and()
            .logout().logoutSuccessUrl("/login/login?logout")                                    
                .permitAll()
            .and()
                .csrf().disable();

}
}

and my AutProvider class

@Component
public class AutProvider implements AuthenticationProvider {

@Override
public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {

    String name = null;
    String password = null;
    Authentication auth = null;

    try {
        name = authentication.getName();
        password = authentication.getCredentials().toString();

        if (name.equals("[e-mail]") && password.equals("password")) {
            List<GrantedAuthority> grantedAuths = new ArrayList<>();
            grantedAuths.add(new SimpleGrantedAuthority("PERM_DELETE"));

            auth = new UsernamePasswordAuthenticationToken(name, password, grantedAuths);
        }
    } catch (AuthenticationException e) {
        e.printStackTrace();
        throw e;
    }

    return auth;
}

and here is how I call the logout link in my page

<div id="logout" class="btn-header transparent pull-right">
        <span> <a href="../login/login?logout.html" title="Sign Out" data-action="userLogout" data-logout-msg="You can improve your security further after logging out by closing this opened browser"><i class="fa fa-sign-out"></i></a> </span>
    </div>

I tried changing

href="../login/login?logout.html"

to

href="../j_spring_security_logout"`

but when I do this it says 404 not found.

[Arun Kumarr]

Jhon from this post and your previous post, I think you are struggling to match paths and how it is mapped to URLs.
Can you assiduously go through the links, I've mentioned below?

1. http://docs.spring.io/spring-framework/docs/2.5.x/api/org/springframework/util/AntPathMatcher.html
2. Link 1 should be sufficient. If needed, do read from this link more - http://ant.apache.org/manual/dirtasks.html#patterns. If not, skip this and move.
3. Go through the configurations mentioned in the spring mvc site. - http://docs.spring.io/spring/docs/current/spring-framework-reference/html/mvc.html
4. An example for the above (3) is here - http://www.springbyexample.org/examples/simple-spring-mvc-form-annotation-config-webapp.html

Once you're done, you might want to learn FrontControllers and View Resolvers (here).
Finally, this is good read - http://www.javaranch.com/journal/200603/frontman.html

Also, to understand passing querystrings - you need to check this.
1. https://coderanch.com/t/584771/JSP/java/Passing-parameters-URL-query-string
2. https://www.daniweb.com/web-development/jsp/threads/394222/pass-multiple-value-in-query-string-in-jsp

[Arun Kumarr]

Why is your logout coming via login?
What are you intending to do in this code - "login/login?logout"

[Jhon Parker]

Arun Kumarr wrote:Why is your logout coming via login?
What are you intending to do in this code - "login/login?logout"

here is my controller that would handle that path

@RequestMapping (value = "login", method = RequestMethod.GET)
    public String login (Model model, @RequestParam(value = "logout", required = false) String logout) 
    {


        
        return "/login/login";
    }

this works but i return the same login page that i have, i did this because when i try to map the same path form my logoutUrl and successLogOutUrl i get a loop errror because i think that i can't use the same url for both

here is my actual secuirty configuration

  .formLogin()
                    .loginPage("/login/login")
                    .permitAll()
                    .and()
                .logout()                                    
                    .permitAll()
                    .logoutUrl("/login/logOutPage")
                    .logoutSuccessUrl("/login/login")

i created a logOut page that is a exact copy of my login page, because when i use /login/login?logout it works i see the login page again but i'm not logout at all, i can put any direction in my search bar and i will go there without having to login.

that's why i created a exact copy of my login page but i think it shouldn't be like that, since all the examples i had whatched they use this login?logout url.




Thanks for the info you posted it helped me to understand betterr the **/ notation

[Arun Kumarr]

Here is a very simple logout mechanism worked out by spring.
Try using it.