In this post we’ll dig into the details of SecurityContextPersistentFilter & LogoutFilter configuration.<\/p>\n
<\/p>\n
The name is quite explicit. The SecurityContextPersistentFilter<\/strong> interface purpose is to store the security context in some repository. <\/p>\n To achieve this task, the filter delegates the job to a SecurityContextRepository<\/strong> interface.<\/p>\n Spring provides a default implementation for this interface: org.springframework.security.web.context.HttpSessionSecurityContextRepository<\/strong>. This is quite self-explanatory. The repository for the security context is simply the current user HTTP session.<\/p>\n Below is the XML configuration for the SecurityContextPersistentFilter<\/strong> <\/p>\n The LogoutFilter<\/strong> is in charge of logging out the current user and invalidating the security context. The task of invalidating the HTTP session is again delegated to another actor, the SecurityContextLogoutHandler<\/strong>.<\/p>\n This handler is injected in the LogoutFilter<\/strong> constructor:<\/p>\n At line 3<\/strong>, we define the URL of the logout page. to be continued…<\/p>\n\n\n<!-- Filter to store the Authentication object in the HTTP Session -->\t\n<bean id="securityContextPersistentFilter" \n\tclass="org.springframework.security.web.context.SecurityContextPersistenceFilter">\n\t<property name="securityContextRepository" ref="securityContextRepository" \/>\n<\/bean>\n\t\n\t\n<bean id="securityContextRepository" \n\tclass="org.springframework.security.web.context.HttpSessionSecurityContextRepository" \/>\n<\/pre>\n
IV LogoutFilter<\/h1>\n
\n<bean id="logoutFilter" \n\tclass="org.springframework.security.web.authentication.logout.LogoutFilter">\n\t<constructor-arg value="\/pages\/Security\/logout.html" \/>\n\t<constructor-arg>\n\t\t<list>\n\t\t\t<bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"\/>\n\t\t<\/list>\n\t<\/constructor-arg>\n\t<property name="filterProcessesUrl" value="\/j_myApplication_logout"\/>\n<\/bean>\n<\/pre>\n
\nThe SecurityContextLogoutHandler<\/strong> is injected as constructor argument at line <\/strong>6.
\nThe HTML URL for the logout action is define by the filterProcessesUrl<\/em> parameter at line 9<\/strong>.<\/p>\n\n<a id="logout_link_id" class="logout-text" \n\thref="\/myApplication\/j_myApplication_logout">Logout<\/a>\t\n<\/pre>\n