Package org.springframework.security.config.annotation.web.configurers.oauth2.client

Class OidcBackChannelLogoutHandler

java.lang.Object
org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcBackChannelLogoutHandler
All Implemented Interfaces:
org.springframework.security.web.authentication.logout.LogoutHandler
public final class OidcBackChannelLogoutHandler extends Object implements org.springframework.security.web.authentication.logout.LogoutHandler
A LogoutHandler that locates the sessions associated with a given OIDC Back-Channel Logout Token and invalidates each one.
Since:
6.4
See Also:

  • Constructor Summary

    Constructors
    Constructor
    Description
    OidcBackChannelLogoutHandler(org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry sessionRegistry)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)
     
    void
    setLogoutUri(String logoutUri)
    Use this logout URI for performing per-session logout.
    void
    setSessionCookieName(String sessionCookieName)
    Use this cookie name for the session identifier.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • OidcBackChannelLogoutHandler

      public OidcBackChannelLogoutHandler(org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry sessionRegistry)

  • Method Details

    • logout

      public void logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)
      Specified by:
      logout in interface org.springframework.security.web.authentication.logout.LogoutHandler

    • setLogoutUri

      public void setLogoutUri(String logoutUri)
      Use this logout URI for performing per-session logout. Defaults to /logout since that is the default URI for LogoutFilter.
      Parameters:
      logoutUri - the URI to use

    • setSessionCookieName

      public void setSessionCookieName(String sessionCookieName)
      Use this cookie name for the session identifier. Defaults to JSESSIONID.

      Note that if you are using Spring Session, this likely needs to change to SESSION.

      Parameters:
      sessionCookieName - the cookie name to use