How to pass parameter along with logout success url in spring security?

Viewed 6398

I am using java based spring security configuration in my spring boot application. When user clicks on logout link, user is redirected to the login page. Here, in this case, I need to pass a custom parameter in the logout success url.

e.g. when I logout, app is redirected to http://localhost:8080/app/login But I want it to have a parameter like below http://localhost:8080/app/login?idletimeout=true

I have created my custom LogoutSuccesshandle for this. I get the param value in the handler and then I construct the success url and then redirect to it. But then on logout that parameter goes missing.

Below is my handler code.

public class LogoutSuccessHandlerImpl extends SimpleUrlLogoutSuccessHandler {

    private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {

        request.getSession().invalidate();
        SecurityContextHolder.clearContext();

        request.setAttribute("isLoggedOut", "true");

        String contextPath = request.getContextPath();
        String redirectURL = "/login";

        String isIdleTimeOut = request.getParameter("idleTimeout");
        request.setAttribute("idleTimeout", isIdleTimeOut);

        System.out.println(isIdleTimeOut + " isIdleTimeOut ");

        if (isIdleTimeOut != null && isIdleTimeOut.equalsIgnoreCase("true")) {
            System.out.println("in if ");
            redirectURL += "?idleTimeout=" + isIdleTimeOut;
        }

        // setDefaultTargetUrl(redirectURL);
        // response.sendRedirect(redirectURL);
       // super.onLogoutSuccess(request, response, authentication);
        redirectStrategy.sendRedirect(request, response, redirectURL);
    }

Below is my java config code.

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
        .and()
            .formLogin()
            .loginPage("/login")
            .loginProcessingUrl("/checkLogin")
            .defaultSuccessUrl("/home")
            .failureUrl("/login?login_error=1")
            .usernameParameter("username")
            .passwordParameter("password")
            .permitAll()
        .and()
            .logout()
            .logoutUrl("/logout")
            .logoutSuccessHandler(new LogoutSuccessHandlerImpl())
            .deleteCookies("JSESSIONID")
            .invalidateHttpSession(true)
            .permitAll()
        .and()
            .authorizeRequests()
            .antMatchers("/login**").permitAll()
            .antMatchers("/error**").permitAll()
            .antMatchers("/checkLogin**").permitAll()
            .anyRequest()
            .authenticated()
            .accessDecisionManager(accessDecisionManager)
        .and()
            .exceptionHandling()
            .accessDeniedPage("/accessDenied")
        .and()
            .headers()
            .frameOptions()
            .disable()
        .and()
            .sessionManagement()
            .invalidSessionUrl("/login")
            .maximumSessions(1);
    }
2 Answers
Related