|  | @@ -35,145 +35,135 @@ import org.springframework.util.Assert;
 | 
	
		
			
				|  |  |  /**
 | 
	
		
			
				|  |  |   * Logs a principal out.
 | 
	
		
			
				|  |  |   * <p>
 | 
	
		
			
				|  |  | - * Polls a series of {@link LogoutHandler}s. The handlers should be specified
 | 
	
		
			
				|  |  | - * in the order they are required. Generally you will want to call logout
 | 
	
		
			
				|  |  | - * handlers <code>TokenBasedRememberMeServices</code> and
 | 
	
		
			
				|  |  | + * Polls a series of {@link LogoutHandler}s. The handlers should be specified in the order they are required.
 | 
	
		
			
				|  |  | + * Generally you will want to call logout handlers <code>TokenBasedRememberMeServices</code> and
 | 
	
		
			
				|  |  |   * <code>SecurityContextLogoutHandler</code> (in that order).
 | 
	
		
			
				|  |  |   * </p>
 | 
	
		
			
				|  |  |   * <p>
 | 
	
		
			
				|  |  |   * After logout, the URL specified by {@link #logoutSuccessUrl} will be shown.
 | 
	
		
			
				|  |  |   * </p>
 | 
	
		
			
				|  |  |   * <p>
 | 
	
		
			
				|  |  | - * <b>Do not use this class directly.</b> Instead configure
 | 
	
		
			
				|  |  | - * <code>web.xml</code> to use the {@link
 | 
	
		
			
				|  |  | - * org.acegisecurity.util.FilterToBeanProxy}.
 | 
	
		
			
				|  |  | + * <b>Do not use this class directly.</b> Instead configure <code>web.xml</code> to use the
 | 
	
		
			
				|  |  | + * {@link org.acegisecurity.util.FilterToBeanProxy}.
 | 
	
		
			
				|  |  |   * </p>
 | 
	
		
			
				|  |  | - * 
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  |   * @author Ben Alex
 | 
	
		
			
				|  |  |   * @version $Id$
 | 
	
		
			
				|  |  |   */
 | 
	
		
			
				|  |  |  public class LogoutFilter implements Filter {
 | 
	
		
			
				|  |  | -	// ~ Static fields/initializers
 | 
	
		
			
				|  |  | -	// =====================================================================================
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -	private static final Log logger = LogFactory.getLog(LogoutFilter.class);
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -	// ~ Instance fields
 | 
	
		
			
				|  |  | -	// ================================================================================================
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -	private String filterProcessesUrl = "/j_acegi_logout";
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -	private String logoutSuccessUrl;
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -	private LogoutHandler[] handlers;
 | 
	
		
			
				|  |  | +    //~ Static fields/initializers =====================================================================================
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	// ~ Constructors
 | 
	
		
			
				|  |  | -	// ===================================================================================================
 | 
	
		
			
				|  |  | +    private static final Log logger = LogFactory.getLog(LogoutFilter.class);
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	public LogoutFilter(String logoutSuccessUrl, LogoutHandler[] handlers) {
 | 
	
		
			
				|  |  | -		Assert.hasText(logoutSuccessUrl, "LogoutSuccessUrl required");
 | 
	
		
			
				|  |  | -		Assert.notEmpty(handlers, "LogoutHandlers are required");
 | 
	
		
			
				|  |  | -		this.logoutSuccessUrl = logoutSuccessUrl;
 | 
	
		
			
				|  |  | -		this.handlers = handlers;
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +    //~ Instance fields ================================================================================================
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	// ~ Methods
 | 
	
		
			
				|  |  | -	// ========================================================================================================
 | 
	
		
			
				|  |  | +    private String filterProcessesUrl = "/j_acegi_logout";
 | 
	
		
			
				|  |  | +    private String logoutSuccessUrl;
 | 
	
		
			
				|  |  | +    private LogoutHandler[] handlers;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	/**
 | 
	
		
			
				|  |  | -	 * Not used. Use IoC container lifecycle methods instead.
 | 
	
		
			
				|  |  | -	 */
 | 
	
		
			
				|  |  | -	public void destroy() {
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +    //~ Constructors ===================================================================================================
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
 | 
	
		
			
				|  |  | -			ServletException {
 | 
	
		
			
				|  |  | -		if (!(request instanceof HttpServletRequest)) {
 | 
	
		
			
				|  |  | -			throw new ServletException("Can only process HttpServletRequest");
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | +    public LogoutFilter(String logoutSuccessUrl, LogoutHandler[] handlers) {
 | 
	
		
			
				|  |  | +        Assert.hasText(logoutSuccessUrl, "LogoutSuccessUrl required");
 | 
	
		
			
				|  |  | +        Assert.notEmpty(handlers, "LogoutHandlers are required");
 | 
	
		
			
				|  |  | +        this.logoutSuccessUrl = logoutSuccessUrl;
 | 
	
		
			
				|  |  | +        this.handlers = handlers;
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -		if (!(response instanceof HttpServletResponse)) {
 | 
	
		
			
				|  |  | -			throw new ServletException("Can only process HttpServletResponse");
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | +    //~ Methods ========================================================================================================
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -		HttpServletRequest httpRequest = (HttpServletRequest) request;
 | 
	
		
			
				|  |  | -		HttpServletResponse httpResponse = (HttpServletResponse) response;
 | 
	
		
			
				|  |  | +    /**
 | 
	
		
			
				|  |  | +     * Not used. Use IoC container lifecycle methods instead.
 | 
	
		
			
				|  |  | +     */
 | 
	
		
			
				|  |  | +    public void destroy() {
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -		if (requiresLogout(httpRequest, httpResponse)) {
 | 
	
		
			
				|  |  | -			Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 | 
	
		
			
				|  |  | +    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
 | 
	
		
			
				|  |  | +            ServletException {
 | 
	
		
			
				|  |  | +        if (!(request instanceof HttpServletRequest)) {
 | 
	
		
			
				|  |  | +            throw new ServletException("Can only process HttpServletRequest");
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -			if (logger.isDebugEnabled()) {
 | 
	
		
			
				|  |  | -				logger.debug("Logging out user '" + auth + "' and redirecting to logout page");
 | 
	
		
			
				|  |  | -			}
 | 
	
		
			
				|  |  | +        if (!(response instanceof HttpServletResponse)) {
 | 
	
		
			
				|  |  | +            throw new ServletException("Can only process HttpServletResponse");
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -			for (int i = 0; i < handlers.length; i++) {
 | 
	
		
			
				|  |  | -				handlers[i].logout(httpRequest, httpResponse, auth);
 | 
	
		
			
				|  |  | -			}
 | 
	
		
			
				|  |  | +        HttpServletRequest httpRequest = (HttpServletRequest) request;
 | 
	
		
			
				|  |  | +        HttpServletResponse httpResponse = (HttpServletResponse) response;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -			sendRedirect(httpRequest, httpResponse, logoutSuccessUrl);
 | 
	
		
			
				|  |  | +        if (requiresLogout(httpRequest, httpResponse)) {
 | 
	
		
			
				|  |  | +            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -			return;
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | +            if (logger.isDebugEnabled()) {
 | 
	
		
			
				|  |  | +                logger.debug("Logging out user '" + auth + "' and redirecting to logout page");
 | 
	
		
			
				|  |  | +            }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -		chain.doFilter(request, response);
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +            for (int i = 0; i < handlers.length; i++) {
 | 
	
		
			
				|  |  | +                handlers[i].logout(httpRequest, httpResponse, auth);
 | 
	
		
			
				|  |  | +            }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	/**
 | 
	
		
			
				|  |  | -	 * Not used. Use IoC container lifecycle methods instead.
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @param arg0 ignored
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @throws ServletException ignored
 | 
	
		
			
				|  |  | -	 */
 | 
	
		
			
				|  |  | -	public void init(FilterConfig arg0) throws ServletException {
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +            sendRedirect(httpRequest, httpResponse, logoutSuccessUrl);
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	/**
 | 
	
		
			
				|  |  | -	 * Allow subclasses to modify when a logout should tak eplace.
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @param request the request
 | 
	
		
			
				|  |  | -	 * @param response the response
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @return <code>true</code> if logout should occur, <code>false</code>
 | 
	
		
			
				|  |  | -	 * otherwise
 | 
	
		
			
				|  |  | -	 */
 | 
	
		
			
				|  |  | -	protected boolean requiresLogout(HttpServletRequest request, HttpServletResponse response) {
 | 
	
		
			
				|  |  | -		String uri = request.getRequestURI();
 | 
	
		
			
				|  |  | -		int pathParamIndex = uri.indexOf(';');
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		if (pathParamIndex > 0) {
 | 
	
		
			
				|  |  | -			// strip everything after the first semi-colon
 | 
	
		
			
				|  |  | -			uri = uri.substring(0, pathParamIndex);
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		if ("".equals(request.getContextPath())) {
 | 
	
		
			
				|  |  | -			return uri.endsWith(filterProcessesUrl);
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		return uri.endsWith(request.getContextPath() + filterProcessesUrl);
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +            return;
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	/**
 | 
	
		
			
				|  |  | -	 * Allow subclasses to modify the redirection message.
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @param request the request
 | 
	
		
			
				|  |  | -	 * @param response the response
 | 
	
		
			
				|  |  | -	 * @param url the URL to redirect to
 | 
	
		
			
				|  |  | -	 * 
 | 
	
		
			
				|  |  | -	 * @throws IOException in the event of any failure
 | 
	
		
			
				|  |  | -	 */
 | 
	
		
			
				|  |  | -	protected void sendRedirect(HttpServletRequest request, HttpServletResponse response, String url)
 | 
	
		
			
				|  |  | -			throws IOException {
 | 
	
		
			
				|  |  | -		if (!url.startsWith("http://") && !url.startsWith("https://")) {
 | 
	
		
			
				|  |  | -			url = request.getContextPath() + url;
 | 
	
		
			
				|  |  | -		}
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		response.sendRedirect(response.encodeRedirectURL(url));
 | 
	
		
			
				|  |  | -	}
 | 
	
		
			
				|  |  | +        chain.doFilter(request, response);
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	public void setFilterProcessesUrl(String filterProcessesUrl) {
 | 
	
		
			
				|  |  | -		Assert.hasText(filterProcessesUrl, "FilterProcessesUrl required");
 | 
	
		
			
				|  |  | -		this.filterProcessesUrl = filterProcessesUrl;
 | 
	
		
			
				|  |  | +    /**
 | 
	
		
			
				|  |  | +     * Not used. Use IoC container lifecycle methods instead.
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @param arg0 ignored
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @throws ServletException ignored
 | 
	
		
			
				|  |  | +     */
 | 
	
		
			
				|  |  | +    public void init(FilterConfig arg0) throws ServletException {
 | 
	
		
			
				|  |  |  	}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | +    /**
 | 
	
		
			
				|  |  | +     * Allow subclasses to modify when a logout should take place.
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @param request the request
 | 
	
		
			
				|  |  | +     * @param response the response
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @return <code>true</code> if logout should occur, <code>false</code> otherwise
 | 
	
		
			
				|  |  | +     */
 | 
	
		
			
				|  |  | +    protected boolean requiresLogout(HttpServletRequest request, HttpServletResponse response) {
 | 
	
		
			
				|  |  | +        String uri = request.getRequestURI();
 | 
	
		
			
				|  |  | +        int pathParamIndex = uri.indexOf(';');
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +        if (pathParamIndex > 0) {
 | 
	
		
			
				|  |  | +            // strip everything after the first semi-colon
 | 
	
		
			
				|  |  | +            uri = uri.substring(0, pathParamIndex);
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +        if ("".equals(request.getContextPath())) {
 | 
	
		
			
				|  |  | +            return uri.endsWith(filterProcessesUrl);
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +        return uri.endsWith(request.getContextPath() + filterProcessesUrl);
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +    /**
 | 
	
		
			
				|  |  | +     * Allow subclasses to modify the redirection message.
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @param request  the request
 | 
	
		
			
				|  |  | +     * @param response the response
 | 
	
		
			
				|  |  | +     * @param url      the URL to redirect to
 | 
	
		
			
				|  |  | +     *
 | 
	
		
			
				|  |  | +     * @throws IOException in the event of any failure
 | 
	
		
			
				|  |  | +     */
 | 
	
		
			
				|  |  | +    protected void sendRedirect(HttpServletRequest request, HttpServletResponse response, String url)
 | 
	
		
			
				|  |  | +            throws IOException {
 | 
	
		
			
				|  |  | +        if (!url.startsWith("http://") && !url.startsWith("https://")) {
 | 
	
		
			
				|  |  | +            url = request.getContextPath() + url;
 | 
	
		
			
				|  |  | +        }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +        response.sendRedirect(response.encodeRedirectURL(url));
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +    public void setFilterProcessesUrl(String filterProcessesUrl) {
 | 
	
		
			
				|  |  | +        Assert.hasText(filterProcessesUrl, "FilterProcessesUrl required");
 | 
	
		
			
				|  |  | +        this.filterProcessesUrl = filterProcessesUrl;
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  |  }
 |