Spring Boot WebFlux项目如何在登出时清除所有Cookie

完整实现代码如下：

import org.springframework.http.HttpCookie;
import org.springframework.http.ResponseCookie;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.util.MultiValueMap;
import java.util.List;
import java.util.Map;

private void deleteCookies(ServerHttpRequest request, ServerHttpResponse response) {
    MultiValueMap<String, HttpCookie> cookies = request.getCookies();
    if (cookies.isEmpty()) {
        return;
    }
    for (Map.Entry<String, List<HttpCookie>> cookieEntry : cookies.entrySet()) {
        List<HttpCookie> cookieList = cookieEntry.getValue();
        for (HttpCookie originalCookie : cookieList) {
            log.debug("Deleting cookie: {} having value: {}", originalCookie.getName(), originalCookie.getValue());
            // 构造失效的ResponseCookie，需匹配原Cookie的domain、path等属性才能正确清除
            ResponseCookie expiredCookie = ResponseCookie.from(originalCookie.getName(), "")
                    .maxAge(0)
                    .path(originalCookie.getPath())
                    .domain(originalCookie.getDomain())
                    .secure(originalCookie.isSecure())
                    .httpOnly(originalCookie.isHttpOnly())
                    .sameSite(originalCookie.getSameSite())
                    .build();
            response.addCookie(expiredCookie);
        }
    }
}

实现注意事项 #

• 不能直接修改请求中获取到的HttpCookie，该类是只读实现，必须构造新的ResponseCookie写入响应
• 必须严格匹配原Cookie的domain、path、secure、httpOnly、sameSite属性，否则客户端会认为是两个不同的Cookie，无法完成原有Cookie的覆盖失效
• 将maxAge设为0会通知浏览器立即删除该Cookie，同时把Cookie值设为空字符串避免冗余

内容的提问来源于stack exchange，提问作者VIJ