SpringSecurity之注销登录

1. 默认logout

spring security在我们配置HttpSecurity的时候就已经默认注册了一个logoutHandler，其路由为/logout，用户可以访问该路由来安全地注销其登录状态，比如session失效、清空remember-me的cookie、清除SecurityContextHandler等等。

2.自定义logout

	http.....
		.logout()
		// 接收注销请求的路由
		.logoutUrl("/myLogout")
		// 登录成功的url
		.logoutSuccessUrl("/index")
		.logoutSuccessHandler(new LogoutSuccessHandler(){
			public void onLogoutSuccess(HttpServletRequest request,HttpServletResponse response,Authentication auth){
				// 处理登录成功的逻辑
			}
		})
		// 销毁session
		.invalidateHttpSession(true)
		// 删除指定的cookie
		.deleteCookies("myCookie1","myCookies2")
		.addLogoutHandler(new LogoutHandler(){
			public void logout(HttpServletRequest request,HttpServletResponse response,Authentication auth){
				// 处理注销的逻辑
			}
		})

实际上，logout的清理过程是由多个LogoutHandler流式处理的

public interface LogoutHandler {
    void logout(HttpServletRequest var1, HttpServletResponse var2, Authentication var3);
}