Hello,
I'm having the exact same problem, and I don't remember changing anything on my security configuration or web.xml configuration.
Here is my web.xml:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/classes/applicationContext.xml</param-value>
</context-param>
<context-param>
<param-name>log4jConfigLocation</param-name>
<param-value>/WEB-INF/classes/log4j.properties</param-value>
</context-param>
<context-param>
<param-name>log4jRefreshInterval</param-name>
<param-value>1000</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter>
<filter-name>hiddenHttpMethodFilter</filter-name>
<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>hiddenHttpMethodFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/classes/applicationContext.xml</param-value>
</init-param>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>default</servlet-name>
<url-pattern>/static/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>dispatcher</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
</web-app>
My security configuration is very similar to the person above, I just don't set a logout-success-url. I've done it to see if it was a problem with that, but didn't solve the problem.
I debugged into org.springframework.security.web.authentication.Ab stractAuthenticationTargetUrlRequestHandler.determ ineTargetUrl(AbstractAuthenticationTargetUrlReques tHandler.java:86) and saw that the request.parameterMap is empty. And also the targetUrlParameter from the LogoutHandler is null.
I noticed that SimpleUrlLogoutSuccessHandler set targetUrlParameter to null
Code:
public class SimpleUrlLogoutSuccessHandler extends AbstractAuthenticationTargetUrlRequestHandler
implements LogoutSuccessHandler {
public SimpleUrlLogoutSuccessHandler() {
super.setTargetUrlParameter(null);
}
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
throws IOException, ServletException {
super.handle(request, response, authentication);
}
}
I found it strange and created a custom LogoutSuccessHandler for the sake of testing.
Code:
public class CustomLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
public CustomLogoutSuccessHandler() {
super.setTargetUrlParameter("nothing");
}
}
And... it worked. I looks like SimpleUrlLogoutSuccessHandler changed from 3.0.5 and added this new constructor.
Hope this helps something.
It is also funny that if you don't initialize the targetUrlParameter with a String, the AbstractAuthenticationTargetUrlRequestHandler also sets it to null.
Code:
public void setTargetUrlParameter(String targetUrlParameter) {
if (!StringUtils.hasText(targetUrlParameter)) {
targetUrlParameter = null;
}
this.targetUrlParameter = targetUrlParameter;
}
And it also changed from 3.0.5:
Code:
public void setTargetUrlParameter(String targetUrlParameter) {
Assert.hasText("targetUrlParameter canot be null or empty");
this.targetUrlParameter = targetUrlParameter;
}
Is this an expected behavior? Should there be any change in the configuration for logout to work this way, with targetUrlParameter == null? Or is this a bug?
Thanks
Spring Security 3.0.6: not directed to logout-success-url
Reply With Quote
Originally Posted by rwinch
