Examples with SecurityContextLogoutHandler org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler used on opensource projects

Example 1 with SecurityContextLogoutHandler

use of org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler in project ORCID-Source by ORCID.

the class BaseController method logoutCurrentUser.

protected void logoutCurrentUser(HttpServletRequest request, HttpServletResponse response) {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (internalSSOManager.enableCookie()) {
        Cookie[] cookies = request.getCookies();
        // Delete cookie and token associated with that cookie
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                if (InternalSSOManager.COOKIE_NAME.equals(cookie.getName())) {
                    try {
                        // If it is a valid cookie, extract the orcid value
                        // and
                        // remove the token and the cookie
                        @SuppressWarnings("unchecked") HashMap<String, String> cookieValues = JsonUtils.readObjectFromJsonString(cookie.getValue(), HashMap.class);
                        if (cookieValues.containsKey(InternalSSOManager.COOKIE_KEY_ORCID) && !PojoUtil.isEmpty(cookieValues.get(InternalSSOManager.COOKIE_KEY_ORCID))) {
                            internalSSOManager.deleteToken(cookieValues.get(InternalSSOManager.COOKIE_KEY_ORCID), request, response);
                        } else {
                            // If it is not valid, just remove the cookie
                            cookie.setValue(StringUtils.EMPTY);
                            cookie.setMaxAge(0);
                            response.addCookie(cookie);
                        }
                    } catch (RuntimeException re) {
                        // If any exception happens, but, the cookie exists,
                        // remove the cookie
                        cookie.setValue(StringUtils.EMPTY);
                        cookie.setMaxAge(0);
                        response.addCookie(cookie);
                    }
                    break;
                }
            }
        }
        // Delete token if exists
        if (authentication != null && !PojoUtil.isEmpty(authentication.getName())) {
            internalSSOManager.deleteToken(authentication.getName());
        }
    }
    if (authentication != null && authentication.isAuthenticated()) {
        new SecurityContextLogoutHandler().logout(request, response, authentication);
    }
    CsrfToken token = csrfTokenRepository.generateToken(request);
    csrfTokenRepository.saveToken(token, request, response);
    request.setAttribute("_csrf", token);
}

Example 2 with SecurityContextLogoutHandler

use of org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method detectsExpiredSessions.

@Test
public void detectsExpiredSessions() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    registry.getSessionInformation(session.getId()).expireNow();
    // Setup our test fixture and registry to want this session to be expired
    SimpleRedirectSessionInformationExpiredStrategy expiredSessionStrategy = new SimpleRedirectSessionInformationExpiredStrategy("/expired.jsp");
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredSessionStrategy);
    filter.setLogoutHandlers(new LogoutHandler[] { new SecurityContextLogoutHandler() });
    filter.afterPropertiesSet();
    FilterChain fc = mock(FilterChain.class);
    filter.doFilter(request, response, fc);
    // Expect that the filter chain will not be invoked, as we redirect to expiredUrl
    verifyZeroInteractions(fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/expired.jsp");
}