How to manually log out a user with spring security?

spring spring-security logout
Erik picture Erik · Apr 20, 2011 · Viewed 93.7k times · Source

Probably the answer is simple: How can I manually logout the currently logged in user in spring security? Is it sufficient to call:

SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false);

?

Answer

Grzegorz Oledzki picture Grzegorz Oledzki · Apr 20, 2011

It's hard for me to say for sure if your code is enough. However standard Spring-security's implementation of logging out is different. If you took a look at SecurityContextLogoutHandler you would see they do:

    SecurityContextHolder.clearContext();

Moreover they optionally invalidate the HttpSession:

    if (invalidateHttpSession) {
        HttpSession session = request.getSession(false);
        if (session != null) {
            session.invalidate();
        }
    }

You may find more information in some other question about logging out in Spring Security and by looking at the source code of org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler.

Related questions

Logout leaves behind JSESSIONID on the browser. How to clear it?

I am using the following code for logging out a user off my system. /** * This function helps to set the session attribute for the present user to null and then * removes the attribute itself and this helps in clearing the …

Read More
Spring security logout goes to j_spring_security_logout

In my web application when I tries to logout it goes to j_spring_security_logout instead of the given page. In my spring-security.xml page i have added <logout logout-success-url="/login" delete-cookies="JSESSIONID" /> The problem is this …

Read More
Spring Security: Redirect to invalid-session-url instead of logout-success-url on successful logout

I have implemented a login-logout system with Spring Security 3.0.2, everything is fine but for this one thing: after I added a session-management tag with invalid-session-url attribute, on logout Spring would always redirect me on the invalid-session-url instead of the logout-success-url (…

Read More