Spring Security: Redirect to invalid-session-url instead of logout-success-url on successful logout

spring spring-security logout session-management
Alessandro picture Alessandro · Apr 8, 2010 · Viewed 23.5k times · Source

I have implemented a login-logout system with Spring Security 3.0.2, everything is fine but for this one thing: after I added a session-management tag with invalid-session-url attribute, on logout Spring would always redirect me on the invalid-session-url instead of the logout-success-url (which it correctly did before).

Is there a way to avoid this behaviour?

This is my configuration:

<http use-expressions="true" auto-config="true">
        [...some intercept-url's...]

    <form-login login-page="/login" authentication-failure-url="/login?error=true"
            login-processing-url="/login-submit" default-target-url="/home"
            always-use-default-target="true" />

    <logout logout-success-url="/home?logout=true" logout-url="/login-logout" />

    <session-management invalid-session-url="/home?invalid=true" />
</http>

Thanks a lot.

Answer

Christopher Yang picture Christopher Yang · Jan 3, 2013

By default, the logout process will first invalidate the session, hence triggering the session management to redirect to the invalid session page. By specifying invalidate-session="false" will fix this behavior.

<sec:logout logout-success-url="/logout" invalidate-session="false" 
delete-cookies="JSESSIONID" />

Related questions

How to manually log out a user with spring security?

Probably the answer is simple: How can I manually logout the currently logged in user in spring security? Is it sufficient to call: SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false); ?

Read More
Logout leaves behind JSESSIONID on the browser. How to clear it?

I am using the following code for logging out a user off my system. /** * This function helps to set the session attribute for the present user to null and then * removes the attribute itself and this helps in clearing the …

Read More
Spring security logout goes to j_spring_security_logout

In my web application when I tries to logout it goes to j_spring_security_logout instead of the given page. In my spring-security.xml page i have added <logout logout-success-url="/login" delete-cookies="JSESSIONID" /> The problem is this …

Read More