Reputation: 6280
I'm working on a spring-mvc based java app at the moment.
One of the features of this app is that the user can change their email address to another email address.
When the user changes their email address, current state functionality is to log the user out in the same operation, which is achieved by returning
redirect:/j_spring_security_logout
from the controller method that updates the users email address.
New webapp functionality is to only support POST (not GET) for logout, which causes the current functionality of logging out the user on email address change to break.
What is the suggested way around this?
Can I:
a) Send a POST somehow from the server side to log the user out?
b) Logout the user server side somehow (invalidate their session, clear their cookies, and redirect them to the login page?)?
c) Should the user be being logged out on email address change in any case or is this a strange thing to do?
Any advice is more than appreciated.
Upvotes: 1
Views: 65
Reputation: 124506
When using Spring Security with a Servlet 3.0 (or higher) capable container it integrates with the HttpServletRequest.logout
method. When calling this method it will trigger the registered Spring Security LogoutHandler
. Afterwards you can redirect to the page you want.
@RequestMapping
public String yourMethod(HttpServletRequest request) {
// your logic here
request.logout(); // Logout to force a re-login
return "redirect:/login"; // redirect to page you want
}
Upvotes: 1