在Spring Security应用程序中使用其余模板注销

Question

我正在为我的应用程序编写客户端。 Spring堆栈是Spring 4和Spring Security 4（主要部分）。

我尝试从我通过以下方式申请注销：

HttpHeaders httpHeaders = new HttpHeaders(); 
httpHeaders.setContentType(MediaType.APPLICATION_FORM_URLENCODED); 
HttpEntity<String> entity = new HttpEntity<>("_csrf=" + csrfToken, 
              httpHeaders); 
restTemplate.postForEntity(appUrl + "/logout", entity, String.class); 

一个RestTemplate对象通过以下方式创建（当然登录前）：

new RestTemplate(new HttpComponentsClientHttpRequestFactory()) 

但我得到的以下例外在服务器上：

org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported at 
org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.handleNoMatch(RequestMappingInfoHandlerMapping.java:207) at 
org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java:374) at 
org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:314) at 
org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:61) at 
org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:352) 

我得到以下excep当我试图登录的应用程序。我设法做的唯一的 方法是获取登录页面并从那里获取CSRF令牌。我试图从以下方式从服务器获取令牌，并将其返回给客户端：

@RequestMapping(value = "/api/csrf", method = RequestMethod.GET) 
public String csrf(HttpServletRequest httpServletRequest) { 
    return ((CsrfToken) httpServletRequest.getAttribute(CsrfToken.class.getName())).getToken(); 
} 

但有了这个令牌我得到相同的异常所有的时间。

现在我想至少以任何方式实现注销，但与RestTemplate正确登录相关的笔记也是值得赞赏的。谢谢！

UPDATE：增加安全配置

public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    private final DataSource dataSource; 
    private final UserDetailsService splittingRolesUserDetails; 
    private final AccessDeniedHandler accessDeniedHandler; 

    @Autowired 
    public SecurityConfig(DataSource dataSource, UserDetailsService splittingRolesUserDetails, 
          AccessDeniedHandler accessDeniedHandler) { 
     this.dataSource = dataSource; 
     this.splittingRolesUserDetails = splittingRolesUserDetails; 
     this.accessDeniedHandler = accessDeniedHandler; 
    } 

    // overrides role prefix in case .access() in httpSecurity configuration 
    // just because it is needed in the task. hasRole() won't work 
    // as there are used different voters in AffirmativeBased. 
    // link to the related issue on GitHub: 
    // https://github.com/spring-projects/spring-security/issues/3701 
    @Bean 
    GrantedAuthorityDefaults grantedAuthorityDefaults() { 
     return new GrantedAuthorityDefaults(""); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { 
     authenticationManagerBuilder 
      .authenticationProvider(authenticationProvider()) 
      .jdbcAuthentication() 
      .dataSource(dataSource) 
      .usersByUsernameQuery("select user_name, password, true from user where username=?"); 
    } 

    @Bean 
    public DaoAuthenticationProvider authenticationProvider() { 
     DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); 
     authProvider.setUserDetailsService(splittingRolesUserDetails); 
     authProvider.setPasswordEncoder(passwordEncoder()); 
     return authProvider; 
    } 

    @Bean 
    public PasswordEncoder passwordEncoder(){ 
     return new BCryptPasswordEncoder(); 
    } 

    @Override 
    protected void configure(HttpSecurity httpSecurity) throws Exception { 
     httpSecurity 
      .authorizeRequests() 
       .antMatchers("/login/**").permitAll() 
       .antMatchers("/api/csrf").permitAll() 
       .antMatchers("/api/ticket/event**").access("hasRole('" + Role.BOOKING_MANAGER.toString() + "')") 
       .anyRequest().access("hasRole('" + Role.REGISTERED_USER.toString() + "')") 
      .and() 
       .formLogin() 
       .loginPage("/login") 
       .defaultSuccessUrl("/event") 
       .permitAll() 
      .and() 
       .exceptionHandling() 
       .accessDeniedHandler(accessDeniedHandler) 
       .accessDeniedPage("/403") 
      .and() 
       .rememberMe() 
       .userDetailsService(splittingRolesUserDetails); 
    } 
} 

Answer 1

无需从没有固定一个端点，这对矛盾该令牌首先使用的原则，把你的令牌。您可以通过添加给你的配置与HTTP只能访问一个cookie存储您的令牌：

.and().csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); 

然后，您可以从一个叫XSRF-TOKEN cookie中检索它。