Spring Security登出过滤器前置致OIDC登出失败求助

• 不解为何Spring Security的Logout Filter位于所有认证过滤器之前
• Spring Boot对接OIDC提供商时，自定义LogoutSuccessHandler实现登出逻辑，但Authentication对象始终为null，导致OIDC提供商的结束会话端点从未被调用
• 相关配置代码：

.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.logout(logout->logout
        .deleteCookies("JSESSIONID")
        .clearAuthentication(true)
        .invalidateHttpSession(true)
        .logoutSuccessHandler(oidcLogoutSuccessHandler())
)
;
return http.build();
}

private LogoutSuccessHandler oidcLogoutSuccessHandler() {
    OidcClientInitiatedLogoutSuccessHandler oidcLogoutSuccessHandler =
            new OidcClientInitiatedLogoutSuccessHandler(this.clientRegistrationRepository);
    oidcLogoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}");
    return oidcLogoutSuccessHandler;
}

• 调试截图：
  

1. Logout Filter位置的原因 #

默认情况下Spring Security的LogoutFilter排在多数认证过滤器之前，这是因为登出操作本身不需要强制认证（比如允许匿名用户触发登出、处理已过期会话）。但在**无状态(STATELESS)**模式下，你的认证逻辑（比如JWT解析）通常通过自定义过滤器实现，若这些过滤器排在LogoutFilter之后，登出请求到达LogoutFilter时，SecurityContext里还没有Authentication对象，就会出现你遇到的问题。

2. 解决Authentication为null的问题 #

方法一：调整LogoutFilter的执行顺序 #

确保LogoutFilter在你的认证过滤器之后执行，让认证过滤器先将Authentication存入SecurityContext。比如使用JWT认证过滤器的场景：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, JwtAuthenticationFilter jwtAuthFilter) throws Exception {
    http
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
            .logout(logout -> logout
                    .deleteCookies("JSESSIONID")
                    // 无状态模式下以下两个配置无效，可移除
                    // .clearAuthentication(true)
                    // .invalidateHttpSession(true)
                    .logoutSuccessHandler(oidcLogoutSuccessHandler())
            );
    return http.build();
}

如果使用Spring Security OAuth2内置的BearerTokenAuthenticationFilter，可通过FilterOrderRegistration调整顺序：

@Bean
public FilterOrderRegistration logoutFilterOrder() {
    FilterOrderRegistration registration = new FilterOrderRegistration();
    registration.setFilter(new LogoutFilter(oidcLogoutSuccessHandler(), new SecurityContextLogoutHandler()));
    // 设置在BearerTokenAuthenticationFilter之后执行
    registration.setOrder(FilterOrderRegistration.LOGOUT_FILTER.getOrder() + 10);
    return registration;
}

方法二：在LogoutSuccessHandler中手动获取Authentication #

若调整顺序有困难，可重写OidcClientInitiatedLogoutSuccessHandler的onLogoutSuccess方法，手动从请求中提取令牌并解析出Authentication：

private LogoutSuccessHandler oidcLogoutSuccessHandler() {
    OidcClientInitiatedLogoutSuccessHandler oidcLogoutSuccessHandler =
            new OidcClientInitiatedLogoutSuccessHandler(this.clientRegistrationRepository) {
                @Override
                public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
                    if (authentication == null) {
                        // 从请求头获取JWT令牌并解析
                        String authHeader = request.getHeader("Authorization");
                        if (authHeader != null && authHeader.startsWith("Bearer ")) {
                            String token = authHeader.replace("Bearer ", "");
                            // 替换为你的JWT解析逻辑，生成Authentication对象
                            authentication = yourJwtParser.parseToken(token);
                            SecurityContextHolder.getContext().setAuthentication(authentication);
                        }
                    }
                    super.onLogoutSuccess(request, response, authentication);
                }
            };
    oidcLogoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}");
    return oidcLogoutSuccessHandler;
}

方法三：使用Spring Security OAuth2内置登出配置 #

如果是基于Spring Security OAuth2 Client的OIDC集成，推荐直接使用内置配置，它会自动处理OIDC结束会话流程：

http
        .oauth2Login(oauth2 -> oauth2
                .clientRegistrationRepository(clientRegistrationRepository)
        )
        .logout(logout -> logout
                .logoutSuccessUrl("/")
                .addLogoutHandler(new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository))
        );

内容的提问来源于stack exchange，提问作者Михаил Катков