Skip to content

Spring security's ServerLogoutHandler order problem. #14379

Closed
@quentin-lipeng

Description

@quentin-lipeng

Expected Behavior
If spring security with spring session,the DelegatingServerLogoutHandler's delegates must be sorted

the SecurityContextServerLogoutHandler must be before WebSessionServerLogoutHandler in DelegatingServerLogoutHandler constructor.
Current Behavior
If WebSessionServerLogoutHandler be before SecurityContextServerLogoutHandler add to DelegatingServerLogoutHandler's delegates,
The WebSessionServerLogoutHandler delete session id from redis, then SecurityContextServerLogoutHandler will not obtain sessionid to operrate,this will occure Session was invalidated.

The spring security doc showed DelegatingServerLogoutHandler logoutHandler = new DelegatingServerLogoutHandler( new WebSessionServerLogoutHandler(), new SecurityContextServerLogoutHandler() );
This will be problem.
Context
sprin security with spring session and redis to store sessionId.

Metadata

Metadata

Assignees

Labels

in: docsAn issue in Documentation or samplestype: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions