CODEWITHSUNDEEP
javasecurityplayframework
TheGuyNextDoor
TheGuyNextDoor

Reputation: 7937

Redirect to previous url after logout

On login, a user can be redirected to the page that requested login using the url value set in flash.

Is is possible to have the same use case, redirect the user to the page that requested the logout action after logout?

Upvotes: 0

Views: 6876

Answers (3)

Bane
Bane

Reputation: 1782

Having found the other answers here unacceptable (or just didn't quite fit my approach) I pinged-away until I came up with something I like better. Here's what I did:

public class Security extends Secure.Security {

    /* Overrides the same method from Secure.Security.
     * I only needed to redirect back the home-page so I just
     * hard-coded the redirect-url here; but you could also have
     * directed your logout-link to #logout2(String url) where you do a
     * flash#put() and then here do a flash#get() and redirect to
     * to that url instead (see n002213f's answer for more detail; 
     * but I thought it bad-practice to do the other half of his 
     * answer -- directly modifying the #logout() method of the
     * play#secure-module)
    static void onDisconnected() {
        redirect( "/" );
    }

}


index.html:
    (...) <a href="logout">Logout</a> (...)

So what happens here is that the default play#secure#logout() is called and at the end of the logout-process it fires Secure#Security#onDisconnected -- which is overridden and redirects to the home-page. This way play's own built-in security isn't being bypassed so you're not risking breaking your security, you also aren't directly modifying the play#secure-module code which means when it's updated you won't find yourself in a pickle, and yet you are achieving your result: not being redirected to the default play#secure-login page, but instead going straight back to the homepage.

If anyone more seasoned with Play! than I see a problem with this (or if my criticism of the other solutions is unfounded) I'd love to hear back!

Otherwise I think this is the most elegant and simplest way to achieve the goal.

Upvotes: 2

rahul
rahul

Reputation: 1290

(Just elucidating allenskd's comment)

A lot depends on how your logout is implemented, but if it's just a controller or a jsp, you don't have to pass the url to it. You can use the referer header.

String refererUrl = request.getHeader("referer")

Upvotes: 8

TheGuyNextDoor
TheGuyNextDoor

Reputation: 7937

thank you all for the comments on the question, going with Johan Sjöberg's suggestions, even stackoverflow is using it ;-), check the logout link.

On the template

<a href="@{Secure.logout2(request.url)}">logout</a>

In Secure.java i added logout2

public static void logout2(String returnUrl) throws Throwable {
    flash.put("returnUrl", returnUrl == null ? "/" : returnUrl);
    logout();
}

and modified logout

public static void logout() throws Throwable {
    session.clear();
    response.removeCookie("rememberme");
    Security.invoke("onDisconnected");
    flash.success(Messages.get("secure.logout", "You have been successfully logged out"));

    String returnUrl = flash.get("returnUrl");
    redirect(returnUrl == null ? "/" : returnUrl);
}

Upvotes: 2

Related Questions