logout

A pretty simple requirement. After logging into web J2EE 6 application, how can I have the user logout again? Most (all?) the books and tutorials I have seen show how to add a login/loginerror page to their application and demonstrate the use of security principals/roles/realms etc using the "j_security_check" method - all good. But then it's not clear how to give the user the power to logout. Indeed, how can I force a logout after, say, the session times out, etc? You should have logout servlet/jsp which invalidates the session using the following ways: Before Servlet 3.0, using session

Probably the answer is simple: How can I manually logout the currently logged in user in spring security? Is it sufficient to call: SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false); ? In Servlet 3.0 container Spring logout functionality is integrated with servlet and you just invoke logout() on your HttpServletRequest . Still need to write valid response content. According to documentation (Spring 3.2): The HttpServletRequest.logout() method can be used to log the current user out. Typically this means that the SecurityContextHolder will be cleared out, the

I am having trouble getting my system to log out with PassportJS. It seems the logout route is being called, but its not removing the session. I want it to return 401, if the user is not logged in in specific route. I call authenticateUser to check if user is logged in. Thanks a lot! /******* This in index.js *********/ // setup passport for username & passport authentication adminToolsSetup.setup(passport); // admin tool login/logout logic app.post("/adminTool/login", passport.authenticate('local', { successRedirect: '/adminTool/index.html', failureRedirect: '/', failureFlash: false }) ); app

HTTP basic authentication credentials are stored until the browser is closed, but is there a way to remove the credentials before the browser is closed? I read about a trick with HTTP 401 status code , but it seems to work not properly (see comment to answer). Maybe the mechanism trac uses is the solution . Can the credentials be deleted with JavaScript? Or with a combination of JavaScript and the status 401 trick? Jan. Update : This solution does not seem to work anymore in many browsers. Kaitsu's comment: This solution of sending false credentials to make browser forget the correct