Skip to content

Commit e313e6b

Browse files
committed
Apply DefaultLoginPageConfigurer before logout
If they are not applied in this order, then the LogoutConfigurer cannot set the logoutSuccessUrl, because the DefaultLoginPageGeneratingFilter does not exist yet. This impacts users that inject the default HttpSecurity bean. Closes gh-9973
1 parent 5137a65 commit e313e6b

File tree

2 files changed

+13
-1
lines changed

2 files changed

+13
-1
lines changed

config/src/main/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,8 @@ HttpSecurity httpSecurity() throws Exception {
9494
.requestCache(withDefaults())
9595
.anonymous(withDefaults())
9696
.servletApi(withDefaults())
97-
.logout(withDefaults())
9897
.apply(new DefaultLoginPageConfigurer<>());
98+
http.logout(withDefaults());
9999
// @formatter:on
100100
return http;
101101
}

config/src/test/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfigurationTests.java

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,18 @@ public void loginWhenUsingDefaultsThenDefaultLoginPageGenerated() throws Excepti
187187
this.mockMvc.perform(get("/login")).andExpect(status().isOk());
188188
}
189189

190+
@Test
191+
public void loginWhenUsingDefaultsThenDefaultLoginFailurePageGenerated() throws Exception {
192+
this.spring.register(SecurityEnabledConfig.class).autowire();
193+
this.mockMvc.perform(get("/login?error")).andExpect(status().isOk());
194+
}
195+
196+
@Test
197+
public void loginWhenUsingDefaultsThenDefaultLogoutSuccessPageGenerated() throws Exception {
198+
this.spring.register(SecurityEnabledConfig.class).autowire();
199+
this.mockMvc.perform(get("/login?logout")).andExpect(status().isOk());
200+
}
201+
190202
@RestController
191203
static class NameController {
192204

0 commit comments

Comments
 (0)