使 Spring Boot MVC 应用程序中的会话（注销）无效

Question

我正在尝试最简单的登录和注销方式Spring MVC。我是 .NET 专家，当我记得我ASP.NET很快就实现了会话身份验证。现在，我必须使用Spring MVC，我面临的问题是我在我的logout方法中得到了不同的会话对象，所以我不能取消它。我在login方法中创建会话属性，我使用逻辑的地方在我的ProductsController. 这是代码：

登录方式：

 @PostMapping

    @RequestMapping(value = {"login"},method = RequestMethod.POST)

    public ResponseEntity Login(@RequestBody @Valid LoginModel user, HttpServletRequest request,HttpSession session){

        List<User> userFromDb=service.findByEmailAndPassword(user.getEmail(),user.getPassword());

        if(!userFromDb.isEmpty()){

            session.setAttribute("loggedInUser", user );

            return new ResponseEntity(HttpStatus.OK);

        }

        return new ResponseEntity(HttpStatus.UNAUTHORIZED);

    }

注销方法：

 @GetMapping

   @RequestMapping(value = {"logout"},method = RequestMethod.GET)

   public ResponseEntity Logout(HttpServletRequest request, SessionStatus 

 status,HttpSession session, HttpServletResponse response){

    session.invalidate();

//        request.getSession(true).removeAttribute("loggedInUser");

//

//        request.getSession(true).invalidate();

    Cookie[] cookies = request.getCookies();

    if(cookies!=null) {

        for (Cookie cookie : cookies) {

            cookie.setMaxAge(0);

            cookie.setValue(null);

            cookie.setPath("/");

            response.addCookie(cookie);

        }

    }

    return new ResponseEntity(HttpStatus.OK);

}

产品控制器：

RequestMapping(value = {"","/"},method = RequestMethod.GET)

    @GetMapping

    public ResponseEntity Products(HttpServletRequest request, HttpSession session){

        if(session==null || session.getAttribute("loggedInUser")==null){

            return new ResponseEntity(HttpStatus.UNAUTHORIZED);

        }

        List<Product> products= service.getAll();

        return new ResponseEntity(products,HttpStatus.OK);

    }

我可以登录并且用户保存在会话中。但是，当我注销时，我仍然可以访问我的产品页面，这意味着该会话未被清除。

如果那很重要，我正在使用create-react-app端口上的前端在 craeted 上使用 React 应用程序localhost:3000，并且我的服务器已打开localhost:8080。

Answer 1

在您的配置类（实现）中使用 spring 安全约束和注销配置WebSecurityConfigurerAdapter：@Configuration@EnableWebSecuritypublic class SecurityConfig extends WebSecurityConfigurerAdapter {&nbsp; &nbsp; .&nbsp; &nbsp; ...&nbsp; &nbsp; ...&nbsp; &nbsp; @Override&nbsp; &nbsp; protected void configure(HttpSecurity http) throws Exception {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;http&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .csrf().disable()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .authorizeRequests()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .antMatchers("/login*").permitAll()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .anyRequest().authenticated()&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .anyRequest().authenticated()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ....&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .and()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .logout()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .invalidateHttpSession(true)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .deleteCookies("JSESSIONID")&nbsp; &nbsp; }&nbsp; &nbsp; ...&nbsp; &nbsp; ...&nbsp; &nbsp; ...&nbsp; &nbsp;&nbsp;}