Spring OAuth2客户端登出功能失效，请求修复指导

Let's break down and fix your logout problems step by step—this is a common gotcha with Spring OAuth2 clients and AJAX requests.

Root Causes of Your Issues #

1. Default Logout Behavior: Spring's default logout handler redirects to the authorization server's post-logout page, which doesn't play nice with AJAX requests (your frontend can't automatically follow that redirect).
2. Incomplete Session Clearing: You might not be invalidating both the client-side session and telling the authorization server to revoke the user's session.
3. CSRF Protection: AJAX POST requests to /client/logout need a valid CSRF token, otherwise Spring Security will block the request (even if you don't see an error in logs).

Step 1: Update Your Security Configuration #

Replace your existing WebSecurityConfigurerAdapter setup with this, which handles both regular and AJAX logout requests properly:

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final ClientRegistrationRepository clientRegistrationRepository;

    // Inject the client registration repo to handle authorization server logout
    public SecurityConfig(ClientRegistrationRepository clientRegistrationRepository) {
        this.clientRegistrationRepository = clientRegistrationRepository;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // Protect all endpoints
            .authorizeRequests(auth -> auth.anyRequest().authenticated())
            // Keep your existing OAuth2 login setup
            .oauth2Login()
            .and()
            .logout(logout -> logout
                // Your custom logout endpoint
                .logoutUrl("/client/logout")
                // Tell the authorization server to log the user out too
                .addLogoutHandler(new OAuth2ClientLogoutHandler(clientRegistrationRepository))
                // Custom success handler to handle AJAX vs regular requests
                .logoutSuccessHandler((request, response, authentication) -> {
                    String acceptHeader = request.getHeader("Accept");
                    // For AJAX requests, return JSON instead of redirecting
                    if (acceptHeader != null && acceptHeader.contains("application/json")) {
                        response.setStatus(HttpStatus.OK.value());
                        response.setContentType("application/json");
                        response.getWriter().write("{\"message\":\"Logout successful\"}");
                    } else {
                        // For regular browser requests, redirect to your home page
                        response.sendRedirect("/");
                    }
                })
                // Invalidate the client-side session
                .invalidateHttpSession(true)
                // Clear session cookies
                .deleteCookies("JSESSIONID")
            )
            // Configure CSRF to work with AJAX (allow frontend to access the token)
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            );
    }
}

Step 2: Fix Your Frontend AJAX Logout #

Make sure your AJAX request includes the CSRF token and handles the response correctly:

function handleLogout() {
    // Extract CSRF token from cookies (set by Spring's CookieCsrfTokenRepository)
    const csrfToken = document.cookie.split('; ')
        .find(row => row.startsWith('XSRF-TOKEN='))
        ?.split('=')[1];

    if (!csrfToken) {
        console.error("CSRF token not found");
        return;
    }

    fetch('/client/logout', {
        method: 'POST',
        headers: {
            'X-XSRF-TOKEN': csrfToken,
            'Accept': 'application/json'
        },
        credentials: 'include' // Ensure session cookies are sent with the request
    })
    .then(response => {
        if (response.ok) {
            // Redirect to home/login page after successful logout
            window.location.href = '/';
        } else {
            throw new Error("Logout failed");
        }
    })
    .catch(error => console.error("Logout error:", error));
}

Step 3: Verify Your application.yml Configuration #

Double-check that your OAuth2 client registration includes all necessary fields (this ensures the OAuth2ClientLogoutHandler can communicate with your authorization server):

spring:
  security:
    oauth2:
      client:
        registration:
          # Replace with your client ID/settings
          your-client-id:
            client-id: your-client-id
            client-secret: your-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid, profile, email
        provider:
          # Replace with your authorization server details
          your-provider-id:
            authorization-uri: http://localhost:8080/oauth2/authorize
            token-uri: http://localhost:8080/oauth2/token
            user-info-uri: http://localhost:8080/oauth2/userinfo
            jwk-set-uri: http://localhost:8080/oauth2/jwks

Why This Works #

• OAuth2ClientLogoutHandler: Automatically sends a request to your authorization server's logout endpoint to revoke the user's session there, so they can't just re-authenticate without logging in again.
• Custom logoutSuccessHandler: Avoids the unwanted redirect to http://localhost:9999/client by returning JSON for AJAX requests, which your frontend can handle cleanly.
• CSRF Configuration: CookieCsrfTokenRepository.withHttpOnlyFalse() lets your frontend read the CSRF token from a cookie, which is required to make a valid POST request to /client/logout.
• Session Clearing: invalidateHttpSession(true) and deleteCookies ensure the client-side session is fully invalidated, so the user can't access protected paths after logout.

内容的提问来源于stack exchange，提问作者gstackoverflow