Oauth2 + JWT登出（二）（白名单方案）

效果

登出实现

方案

1. 自己实现一个登出接口
2. 使用Security的WebSecurityConfigurerAdapter，实现登出的handler实现和登出后结果返回的handler即可。

方案一

自己实现登出接口，上一篇已经实现了CustomJwtTokenStore.removeAccessToken()，这里只需要调用即可。

    /**
     * Oauth2 登出
     */
    @ApiOperation(value = "登出")
    @PostMapping("/ssologout")
    public Result logout(@RequestBody LogoutParamDto logoutParamDto) {
        OAuth2AccessToken accessToken = tokenStore.readAccessToken(logoutParamDto.getAccessToken());
        tokenStore.removeAccessToken(accessToken);
        return Result.succeed("logout success.");
    }

方案二

首先先告诉Security登出地址、addLogoutHandler 和 logoutSuccessHandler。

@Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().authorizeRequests().anyRequest().permitAll()
        .and()
                .logout()
                .logoutUrl("/oauth/remove/token")
                .addLogoutHandler(new OauthLogoutHandler(tokenStore))
                .logoutSuccessHandler(new OauthLogoutSuccessHandler())
                .clearAuthentication(true)
                .and()
                .apply(openIdAuthenticationSecurityConfig).and().cors();
    }

addLogoutHandler 逻辑实现

@Slf4j
public class OauthLogoutHandler implements LogoutHandler {
    private TokenStore tokenStore;

    public OauthLogoutHandler(TokenStore tokenStore) {
        this.tokenStore = tokenStore;
    }

    @Override
    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
        Optional.ofNullable(tokenStore).orElseThrow(() -> new InnerException("tokenStore must be set."));
        String token = request.getParameter("token");
        if (StrUtil.isEmpty(token)) {
            token = AuthUtils.extractToken(request);
        }
        if(StrUtil.isNotEmpty(token)){
            OAuth2AccessToken existingAccessToken = tokenStore.readAccessToken(token);
            OAuth2RefreshToken refreshToken;
            if (existingAccessToken != null) {
                if (existingAccessToken.getRefreshToken() != null) {
                    log.info("remove refreshToken!", existingAccessToken.getRefreshToken());
                    refreshToken = existingAccessToken.getRefreshToken();
                    tokenStore.removeRefreshToken(refreshToken);
                }
                log.info("remove existingAccessToken!", existingAccessToken);
                tokenStore.removeAccessToken(existingAccessToken);
            }
        }
    }

logoutSuccessHandler逻辑实现

public class OauthLogoutSuccessHandler implements LogoutSuccessHandler {
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
        String redirectUri = request.getParameter("redirect_uri");
        if (StrUtil.isNotEmpty(redirectUri)) {
            //重定向指定的地址
            redirectStrategy.sendRedirect(request, response, redirectUri);
        } else {
            ResponseUtil.responseSucceed(new ObjectMapper(), response, "logout success!");
        }
    }
}