要解决该问题,我们需要重写以确保在请求 Auth0 注销时有效。以下是可能的解决方案:
@Component
public class Auth0LogoutFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
// Check if the user is requesting a logout
if ("/logout".equals(request.getRequestURI())) {
String redirectUri = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + request.getContextPath() + "/login";
String logoutUrl = String.format("https://%s/v2/logout?client_id=%s&returnTo=%s", Auth0Config.getDomain(), Auth0Config.getClientId(), redirectUri);
// Redirect the user to the Auth0 logout page
response.sendRedirect(logoutUrl);
return;
}
filterChain.doFilter(request, response);
}
}
@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private Auth0LogoutFilter auth0LogoutFilter;
@Override
protected void configure(HttpSecurity http) throws Exception {
// Configure Spring Security to permit the user to logout
http.logout()
.logoutUrl("/logout")
.logoutSuccessUrl("/login");
// Add the Auth0 logout filter to the Spring Security filter chain
http.addFilterBefore(auth0LogoutFilter, LogoutFilter.class);
}
}
实现以上两个步骤后,应用程序中的用户将能够正常注销并被重定向到登录页。