Package org.springframework.security.config.web.server

Class OidcBackChannelServerLogoutHandler

java.lang.Object

org.springframework.security.config.web.server.OidcBackChannelServerLogoutHandler

All Implemented Interfaces:

ServerLogoutHandler

public final class OidcBackChannelServerLogoutHandler
extends Object
implements ServerLogoutHandler

A ServerLogoutHandler that locates the sessions associated with a given OIDC Back-Channel Logout Token and invalidates each one.

Since:

6.4

See Also:

• OIDC Back-Channel Logout Spec

Constructor Summary

Constructors

Constructor	Description
OidcBackChannelServerLogoutHandler(ReactiveOidcSessionRegistry sessionRegistry)

Method Summary

Modifier and Type	Method	Description
reactor.core.publisher.Mono<Void>	logout(WebFilterExchange exchange, Authentication authentication)	Invoked when log out is requested
void	setLogoutUri(String logoutUri)	Use this logout URI for performing per-session logout.
void	setSessionCookieName(String sessionCookieName)	Use this cookie name for the session identifier.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

OidcBackChannelServerLogoutHandler

public OidcBackChannelServerLogoutHandler(ReactiveOidcSessionRegistry sessionRegistry)

Method Details

logout

public reactor.core.publisher.Mono<Void> logout(WebFilterExchange exchange,
 Authentication authentication)

Description copied from interface: ServerLogoutHandler

Invoked when log out is requested

Specified by:

logout in interface ServerLogoutHandler

Parameters:

exchange - the exchange

authentication - the Authentication

Returns:

a completion notification (success or error)

setLogoutUri

public void setLogoutUri(String logoutUri)

Use this logout URI for performing per-session logout. Defaults to /logout since that is the default URI for LogoutFilter.

Parameters:

logoutUri - the URI to use

setSessionCookieName

public void setSessionCookieName(String sessionCookieName)

Use this cookie name for the session identifier. Defaults to JSESSIONID.

Note that if you are using Spring Session, this likely needs to change to SESSION.

Parameters:

sessionCookieName - the cookie name to use