如何在Spring中注销oauth2客户端？

Question

我有最简单的oauth2客户端：

@EnableAutoConfiguration
@Configuration
@EnableOAuth2Sso
@RestController
public class ClientApplication {

    @RequestMapping("/")
    public String home(Principal user, HttpServletRequest request, HttpServletResponse response) throws ServletException {       
        return "Hello " + user.getName();
    }

    public static void main(String[] args) {
        new SpringApplicationBuilder(ClientApplication.class)
                .properties("spring.config.name=application").run(args);
    }

}

我也有以下的application.yml文件：

server:
  port: 9999
  servlet:
    context-path: /client
security:
  oauth2:
    client:
      client-id: acme
      client-secret: acmesecret
      access-token-uri: http://localhost:8080/oauth/token
      user-authorization-uri: http://localhost:8080/oauth/authorize
    resource:
      user-info-uri: http://localhost:8080/me

logging:
  level:
    org.springframework.security: DEBUG
    org.springframework.web: DEBUG

这是完整的代码。我没有任何额外的源代码。它运行正常。

但现在我想添加一个注销功能。我已经添加了一个端点，但它不起作用。我尝试了以下操作：

@RequestMapping("/logout")
    public void logout(HttpServletRequest request, HttpServletResponse response) throws ServletException {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        authentication.setAuthenticated(false);
        new SecurityContextLogoutHandler().logout(request,response,authentication);
        SecurityContextHolder.clearContext();
        request.logout();
        request.getSession().invalidate();
    }

但是我仍然登录着，并且可以访问/网址，它会向我回复用户名。

你能帮我解决这个问题吗？

更新

我尝试了这里描述的方法：https://spring.io/guides/tutorials/spring-boot-oauth2/#_social_login_logout：

@EnableAutoConfiguration
@Configuration
@EnableOAuth2Sso
@Controller
public class ClientApplication extends WebSecurityConfigurerAdapter {
    private Logger logger = LoggerFactory.getLogger(ClientApplication.class);

    @RequestMapping("/hello")
    public String home(Principal user, HttpServletRequest request, HttpServletResponse response, Model model) throws ServletException {
        model.addAttribute("name", user.getName());
        return "hello";
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http.antMatcher("/**")
                .authorizeRequests()
                .antMatchers( "/login**", "/webjars/**", "/error**").permitAll()
                .anyRequest()
                .authenticated()
                .and().logout().logoutSuccessUrl("/").permitAll()
                .and()
                    .csrf()
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }

    public static void main(String[] args) {
        new SpringApplicationBuilder(ClientApplication.class)
                .properties("spring.config.name=application").run(args);
    }
}

并且在前端我写了：

<script type="text/javascript">
        $.ajaxSetup({
            beforeSend: function (xhr, settings) {
                if (settings.type == 'POST' || settings.type == 'PUT'
                    || settings.type == 'DELETE') {
                    if (!(/^http:.*/.test(settings.url) || /^https:.*/
                            .test(settings.url))) {
                        // Only send the token to relative URLs i.e. locally.
                        xhr.setRequestHeader("X-XSRF-TOKEN",
                            Cookies.get('XSRF-TOKEN'));
                    }
                }
            }
        });
        var logout = function () {
            $.post("/client/logout", function () {
                $("#user").html('');
                $(".unauthenticated").show();
                $(".authenticated").hide();
            });
            return true;
        };
        $(function() {
            $("#logoutButton").on("click", function () {
                logout();
            });
        });

    </script>

和

<input type="button" id="logoutButton" value="Logout"/>

但它仍然无法正常工作，会产生以下行为：

http://localhost:9999/client/logout发布后会重定向到http://localhost:9999/client，但该页面不存在。

github上的源码:
客户端 - https://github.com/gredwhite/logour_social-auth-client (使用 localhost:9999/client/hello url)
服务器 - https://github.com/gredwhite/logout_social-auth-server

- gstackoverflow

---

Post http://localhost:9999/client/logout 重定向到 http://localhost:9999/client，但是该页面不存在。 问题出在哪里？只需添加一个 http://localhost:9999/client 页面，或者配置另一个页面代替 logoutSuccessUrl("/")。 - dur

Answer 1

你可以从数据库中删除刷新令牌和访问令牌，以节省空间。

@PostMapping("/oauth/logout")
public ResponseEntity<String> revoke(HttpServletRequest request) {
    try {
        String authorization = request.getHeader("Authorization");
        if (authorization != null && authorization.contains("Bearer")) {
            String tokenValue = authorization.replace("Bearer", "").trim();

            OAuth2AccessToken accessToken = tokenStore.readAccessToken(tokenValue);
            tokenStore.removeAccessToken(accessToken);

            //OAuth2RefreshToken refreshToken = tokenStore.readRefreshToken(tokenValue);
            OAuth2RefreshToken refreshToken = accessToken.getRefreshToken();
            tokenStore.removeRefreshToken(refreshToken);
        }
    } catch (Exception e) {
        return ResponseEntity.badRequest().body("Invalid access token");
    }

    return ResponseEntity.ok().body("Access token invalidated successfully");
}

注销的URL为：http://localhost:9999/oauth/logout。同时，在Authorization头中传递访问令牌，如下所示：

Authorization: Bearer 0cb72897-c4f7-4f01-aed9-2f3f79a75484

其中，0cb72897-c4f7-4f01-aed9-2f3f79a75484是访问令牌。

由于是Spring security，不要忘记从授权访问中绕过/oauth/logout URL。

public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/hello", "/oauth/logout");
}

希望这能解决你在Springboot2+Oauth2中的注销问题，对我来说它有效。

- Dharmender Rawat

Answer 2

将以下代码片段添加到ClientApplication类中。这也将清除您的会话详细信息。

用下面的代码替换Web安全适配器类的configure方法。

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/**")
                .authorizeRequests()
                .antMatchers( "/login**", "/webjars/**", "/error**").permitAll()
                .anyRequest()
                .authenticated()
                .and().logout().invalidateHttpSession(true)
                .clearAuthentication(true).logoutSuccessUrl("/login?logout").deleteCookies("JSESSIONID").permitAll().and().csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }

- Dharita Chokshi

Answer 3

您可能希望使用Spring Security内置的对/logout端点的支持，它会执行正确的操作（清除会话并使cookie失效）。要配置该端点，请在我们的WebSecurityConfigurer中扩展现有的configure()方法：

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.antMatcher("/**")
     .and().logout().logoutSuccessUrl("/").permitAll();
}

- Eby Jacob

Answer 4

你可以将Post改为Get http://localhost:9999/client/logout

这对我有效

- Evan Gu

Answer 5

尝试将注销URL添加到您的安全配置中。

    .logout()
        .logoutUrl("/logout")
        .logoutSuccessUrl("/")
        .permitAll();

- Rafał Sokalski