CODEWITHSUNDEEP
springspring-securityremember-me
Saurabh Kumar
Saurabh Kumar

Reputation: 16651

how to delete remember me cookie in spring security

I was wondering how to the remove the remember me cookie when using spring remember me services. I am using the default remember me cookie name I came across the following documentation in spring to delete the JSESSION.

    <http>
      <logout delete-cookies="JSESSIONID" />
    </http>

But is it possible to do something like below to delete the remember me cookie as well

I don't have a logout controller and i have the following configuration in the spring xml.

  <http use-expressions="true">
    <!-- Authentication policy -->
    <form-login login-page="/signin" login-processing-url="/signin/authenticate" authentication-failure-url="/signin?param.error=bad_credentials" />
    <logout logout-url="/signout" delete-cookies="JSESSIONID" />
            ....................

Upvotes: 2

Views: 3791

Answers (1)

zagyi
zagyi

Reputation: 17518

I don't think you have to manually delete the remember-me cookie. The AbstractRememberMeServices implements the LogoutHandler interface, so it will receive a call-back from the LogoutFilter, and makes sure the remember-me cookie is cancelled on logout.

Upvotes: 1

Related Questions