spring-projects / spring-projects/spring-security
There is no way to know if a custom logout success handler has been set
@jzheaux is already working on this.
Since May 12, 2025.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
During HttpSecurity build process, a custom configurer might need to know if a custom logout success handler has been set for the LogoutConfigurer, for example:
class MyCustomDsl extends AbstractHttpConfigurer<MyCustomDsl, HttpSecurity> {
@Override
public void init(HttpSecurity http) throws Exception {
var logout = http.getConfigurer(LogoutConfigurer.class);
if (logout.isCustomLogoutSuccess()) { // <-- can't do this now
// custom logout, preserve it
} else {
// no custom logout, customize it
}
}
}
would allow to preserve a custom handler set like this:
http.with(customDsl, withDefaults());
http.logout(logout -> logout.logoutSuccessHandler(customHandler));
Current Behavior
During the init phase of customDsl, it's not possible to know if logout.logoutSuccessHandler has ever been set, since:
LogoutConfigurerdoes not set the custom handler as a shared objectLogoutConfigurer#getLogoutSuccessHandlerreturns a new handler if not already setLogoutConfigurer#isCustomLogoutSuccessis not public
Context
This is affecting my custom handler's ability to set a logout success handler only if the user hasn't already set one. I couldn't find any alternative other than reflection, but I can't use reflection.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.