spring-projects / spring-projects/spring-security
Implicitly perform invalidateHttpSession, clearAuthentication and deleteCookies when customizing the logout success url
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Current Behavior
Currently, customizing just the logout Success Url, requires developer to remember to also perform the 3 important steps for security reason
- invalidate Http Session
- Clear Authentication
- Delete session Cookies
http.logout(loc -> loc.logoutSuccessUrl("/login?logout=true").invalidateHttpSession(true).clearAuthentication(true)
.deleteCookies("JSESSIONID"))
Expected Behavior
Provide an overloaded function , i.e logoutSuccessUrl("/login?logout=true", true) where the new parameter accept a boolean where true (default) mean to perform the 3 steps implicitly.
Reason for enhancement
Many developers will tend to forget to implement the 3 steps. Since these are all related to security, it is best for these steps to be done implicitly and automatically out-of-the-box.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the logoutSuccessUrl API and the existing invalidateHttpSession, clearAuthentication, and deleteCookies options in Spring Security. Determine how an overload with a default-enabled boolean would fit the current logout configuration, then verify that customizing the success URL still performs all three security steps by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100