java Spring 安全性：删除 cookie 以进行注销
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/43773840/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Spring security: Delete cookie for logout
提问by Arian
I use the following security configuration for my Spring boot app:
我对 Spring boot 应用程序使用以下安全配置：
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/login").permitAll()
.and()
.authorizeRequests()
.antMatchers("/signup").permitAll()
.and()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.logout().logoutUrl("/logout").logoutSuccessUrl("/login").deleteCookies("auth_code").invalidateHttpSession(true)
.and()
// We filter the api/signup requests
.addFilterBefore(
new JWTSignupFilter("/signup", authenticationManager(),
accountRepository, passwordEncoder),
UsernamePasswordAuthenticationFilter.class)
// We filter the api/login requests
.addFilterBefore(
new JWTLoginFilter("/login", authenticationManager()),
UsernamePasswordAuthenticationFilter.class)
// And filter other requests to check the presence of JWT in
// header
.addFilterBefore(new JWTAuthenticationFilter(userDetailsServiceBean()),
UsernamePasswordAuthenticationFilter.class);
}
When I do the logout, I want to delete the cookie which was set during the login. I use deleteCookie, but in the header there's no notion of deleting the cookie which was set during the login. Why ?
当我注销时，我想删除在登录期间设置的 cookie。我使用deleteCookie，但在标题中没有删除登录期间设置的 cookie 的概念。为什么 ？
How should I tell the browser to delete the cookie ?
我应该如何告诉浏览器删除 cookie？
Right now, the header for the response contains :
现在，响应的标头包含：
Set-Cookie →JSESSIONID=E4060381B435217F7D68EAAE82903BB0;path=/;Secure;HttpOnly
Should I set the expiration time for the cookie to a date past the current date ?
我应该将 cookie 的过期时间设置为当前日期之后的日期吗？
回答by ThrawnCA
You shouldn't need to delete the cookie. Once the session has closed on the server, the cookie can't be used anyway, and it will be replaced if the person returns. Just let it expire normally (by default, when the browser is closed).
您不需要删除 cookie。一旦会话在服务器上关闭，无论如何都不能使用 cookie，如果此人返回，它将被替换。让它正常过期（默认情况下，当浏览器关闭时）。
回答by shazin
Add JSESSIONIDin the .deleteCookies("auth_code", "JSESSIONID").
添加JSESSIONID在.deleteCookies("auth_code", "JSESSIONID").
logout().logoutUrl("/logout").logoutSuccessUrl("/login").deleteCookies("auth_code", "JSESSIONID").invalidateHttpSession(true)
