Logout is not working in Spring Security

Question

I am writing a security application with Spring Security 4.0. As part of that I want to make a logout call. It is simply giving Request method \'POST\' not supported. Here i

Answer 1

If you use CSRF, you have to use HTTP POST (with a

in your JSP) instead of HTTP GET (with a in your JSP), see Spring Security Reference:

18.5.3 Logging Out

Adding CSRF will update the LogoutFilter to only use HTTP POST. This ensures that log out requires a CSRF token and that a malicious user cannot forcibly log out your users.

One approach is to use a form for log out. If you really want a link, you can use JavaScript to have the link perform a POST (i.e. maybe on a hidden form). For browsers with JavaScript that is disabled, you can optionally have the link take the user to a log out confirmation page that will perform the POST.

For example, see Spring Security Reference:

37.5.1 Automatic Token Inclusion

Spring Security will automatically include the CSRF Token within forms that use the Spring MVC form tag. For example, the following JSP: