X509 logout

Summary

If you configure your Webserver to do X509 authentication only on a specific URL it is possible to use Spring Security's logout function (some kind of work around).
But if you immediately perform an action after logging out, you are still logged in

Details

Logging out with certificate authentication is not really possible via Website. The only solution is to close the browser.
And it's not the best solution to do certificate logins only via a login URL to have the possibility to perform logouts. So its somehow an edge case.
Also this is not at least a security thing, because every User should be informed about how to handle certificates.
But it's not really user friendly to perform an unsuccessful logout.

We chose this quirks implementation, because we want users not to overtax with a certificate request popup when they open the page, even if the don't have certificates. So we chose an extra url where the user can perform certificate login.

Reason and Expected Behavior

Best thing in my use case would be that the user is logged out.
Maybe this could be reached to Configure the Spring app to X509 only on a specified URL (not tested yet, see configuration) if this is possible.

If you perform a logout the "Keep-Alive" http header is sent and the browser is advised to keep the connection open for about 5 seconds.
So the https handshaked connection runs for at least five seconds after logout. So if you perform any action in this time, you are kept logged in.

For more security it might be the best to set the keep alive headers to zero.

Configuration

• Spring MVC app
• Tomcat Server
• Ajp
• Apache Web Server

The Apache webserver has a hardcoded URL where SSLVerification (x509) is enabled and the Cert data are paseed-through to the app via ajp.
Spring Security is globally configured to accept 509 logins.

Version

4.x

Reproduce the logout flow with the described Spring MVC, Tomcat, AJP, and Apache configuration, focusing on the certificate-authenticated URL and Keep-Alive behavior. Determine whether a request made shortly after logout remains authenticated, then define completion as logout preventing that continued access without requiring the browser to close.