1. 技术文章
  2. Request 'OPTIONS /logout' doesn't match 'POST /logout

Request 'OPTIONS /logout' doesn't match 'POST /logout

由 余生颓废 提交于 2019-11-30 19:50:49

Leaving aside the question of why you might want to do this and whether or not it is a good idea: your JS client is POSTing to an endpoint on another server, so you face two problems: Cross-Origin Resource Sharing (CORS) and Cross Site Request Forgery (CSRF), both of which are locked down by default in your Auth Server because it is using Spring MVC and Spring Security.

The CORS problem can be worked around in various ways, including the approach that you took, which was to punch a hole through the security configuration using a request matcher are permitAll(). There is a far better integration between Spring MVC and Spring Security using HttpSecurity.cors(). User guide link: http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#cors. Simple example from the tutorial (vanilla resource server):

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.cors()
        ...;
}

What this does is switch on integration with the MVC declared endpoints with @CrossOrigin. Actually the endpoint you are trying to POST to is not one that you wrote, and it's not a Spring MVC endpoint, so you might have to use cors().configurationSource(...) instead.

The CSRF problem is also easy to solve in various different ways. The tutorial where you started has explicit examples showing how to do it for Angular JS (but not in the app you are using because the tutorial is not about logging out from the SSO provider). In that case we use the HttpSecurity.csrf() features. User guide link: http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf. Simple example from the tutorial in the UI app:

@Override
public void configure(HttpSecurity http) throws Exception {
    http
        ...
        .csrf()
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
}
标签
Spring
spring-security
spring-boot
spring-cloud
spring-oauth2
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!