Spring Security 6中使用securityMatcher时默认/logout失效问题

你配置的SecurityFilterChain通过securityMatcher("/EParticipate/baudit/**")限定了仅处理该路径下的请求，而/logout不在这个路径范围内——因此这条过滤器链完全不会处理/logout请求，哪怕你在requestMatchers里添加/logout并设置permitAll()也没用，因为请求根本没进入这条链。

有两种可行的处理方式，根据业务场景选择：

方式一：扩展当前过滤器链的匹配范围，包含/logout #

修改securityMatcher，把/logout纳入当前链的处理范围，示例代码如下：

@Bean
public SecurityFilterChain openFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/EParticipate/baudit/**", "/logout")
        .addFilterBefore(new BauditUsernamePasswordAuthenticationFilter(
            this.authenticationManager(userDetailsService, passwordEncoder())),
            UsernamePasswordAuthenticationFilter.class
        )
        .authorizeHttpRequests((requests) -> requests
            .dispatcherTypeMatchers(DispatcherType.FORWARD, DispatcherType.ERROR).permitAll()
            .requestMatchers("/EParticipate/baudit/**").hasRole("BAUDIT")
            .requestMatchers("/EParticipateSecurity/**", "/logout").permitAll()
        )
        .authenticationManager(this.authenticationManager(userDetailsService, passwordEncoder()))
        .formLogin(form -> form
            .loginPage("/EParticipateSecurity/login_request").permitAll()
            .defaultSuccessUrl("/EParticipate/baudit")
        )
        // 显式配置logout规则，确保功能生效
        .logout(logout -> logout
            .logoutUrl("/logout")
            .logoutSuccessUrl("/EParticipateSecurity/login_request?logout")
        );
    return http.build();
}

方式二：新增独立过滤器链处理公共路径（推荐） #

如果登录、登出等公共路径不需要和业务路径共用同一条过滤器链，可以创建一个优先级更高的链，专门处理/EParticipateSecurity/**和/logout这类请求：

// 用@Order(1)确保这条链先被执行
@Bean
@Order(1)
public SecurityFilterChain publicFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/EParticipateSecurity/**", "/logout")
        .authorizeHttpRequests(requests -> requests
            .anyRequest().permitAll()
        )
        .formLogin(form -> form
            .loginPage("/EParticipateSecurity/login_request")
            .defaultSuccessUrl("/EParticipate/baudit")
        )
        .logout(logout -> logout
            .logoutUrl("/logout")
            .logoutSuccessUrl("/EParticipateSecurity/login_request?logout")
        );
    return http.build();
}

// 原业务过滤器链，保持原有配置即可
@Bean
public SecurityFilterChain openFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/EParticipate/baudit/**")
        .addFilterBefore(new BauditUsernamePasswordAuthenticationFilter(
            this.authenticationManager(userDetailsService, passwordEncoder())),
            UsernamePasswordAuthenticationFilter.class
        )
        .authorizeHttpRequests((requests) -> requests
            .dispatcherTypeMatchers(DispatcherType.FORWARD, DispatcherType.ERROR).permitAll()
            .anyRequest().hasRole("BAUDIT")
        )
        .authenticationManager(this.authenticationManager(userDetailsService, passwordEncoder()));
    return http.build();
}

额外注意事项 #

• Spring Security 6默认仅接受POST方式的logout请求，你的Thymeleaf表单已正确使用POST，无需修改；若需支持GET请求（不推荐，存在CSRF风险），可在logout配置中添加.permitAll()并通过logoutRequestMatcher开启GET支持。
• 确保CSRF防护处于启用状态（默认启用），Thymeleaf会自动在POST表单中注入CSRF令牌，无需手动添加。

内容的提问来源于stack exchange，提问作者tlarson