Spring security logout handling -

Spring security logout handling -

according spring security 4.0.0 document:

4.2.4 logout handling

the logout element adds back upwards logging out navigating particular url. the default logout url /logout, can set else using logout-url attribute. more info on other available attributes may found in namespace appendix.

however, after next security setting in doc, url /logout doesn't show logout page. instead, shows

on contrary, url /login works properly.

the next setting:

spring framework 4.1.6 spring security 4.0.0

web.xml

<?xml version="1.0" encoding="utf-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemalocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> <display-name>test8</display-name> <welcome-file-list> <welcome-file>index.html</welcome-file> <welcome-file>index.htm</welcome-file> <welcome-file>index.jsp</welcome-file> <welcome-file>default.html</welcome-file> <welcome-file>default.htm</welcome-file> <welcome-file>default.jsp</welcome-file> </welcome-file-list> <filter> <filter-name>springsecurityfilterchain</filter-name> <filter-class>org.springframework.web.filter.delegatingfilterproxy</filter-class> </filter> <filter-mapping> <filter-name>springsecurityfilterchain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class>org.springframework.web.context.contextloaderlistener</listener-class> </listener> <context-param> <param-name>contextconfiglocation</param-name> <param-value>/web-inf/security-config.xml</param-value> </context-param> </web-app>

security-config.xml

<?xml version="1.0" encoding="utf-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <http> <intercept-url pattern="/**" access="hasrole('user')" /> <form-login /> <logout /> </http> <authentication-manager> <authentication-provider> <user-service> <user name="aaa" password="111" authorities="role_user, role_admin" /> <user name="bbb" password="222" authorities="role_user" /> </user-service> </authentication-provider> </authentication-manager> </beans:beans>

spring security automatically enables csrf, automatically disabled logouts. can prepare disabling csrf protection settings <csrf disabled="true"/> in <http> , or using post.

see http://docs.spring.io/spring-security/site/docs/4.0.1.release/reference/htmlsingle/#csrf-logout

spring spring-security