Spring WebFlux creates new session cookie after logout

user_2711833 0
Viewed 156

I have a SpringBoot WebFlux application that uses Netty and Spring Security. In my security config, I have

.logout().logoutUrl("/logout").logoutSuccessHandler(new HttpStatusReturningServerLogoutSuccessHandler())

and I can see that the security context is removed upon a POST to /logout

2022-05-31 11:52:05.700 DEBUG 37892 --- [or-http-epoll-3] o.s.s.w.s.a.logout.LogoutWebFilter       : Logging out user 'AnonymousAuthenticationToken [Principal=anonymous, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_ANONYMOUS]]' and transferring to logout destination
2022-05-31 11:52:05.700 DEBUG 37892 --- [or-http-epoll-3] ebSessionServerSecurityContextRepository : Removed SecurityContext stored in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@1e33c2b6'

but the response infuriatingly contains a new Set-Cookie header for a new Session Cookie! Is this coming from Netty? How can I turn this off? Why is there no session configuration option for ServerHttpSecurity, where I could tell it to make new session only if required?

Any help appreciated, thanks

spring-webflux spring-boot netty spring-security
1 Answers

I figured out that the sessionId is changed in WebSessionServerSecurityContextRepository when the context is removed, but if I add

.logoutHandler(new WebSessionServerLogoutHandler())

to the configuration then it removes the SESSION cookie completely. Hopefully this helps someone else.

user_27118330
Related