Package org.springframework.security.config.annotation.web.configurers.oauth2.client

# Class OidcLogoutConfigurer.BackChannelLogoutConfigurer

java.lang.Object
org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer.BackChannelLogoutConfigurer

Enclosing class:
  OidcLogoutConfigurer<B extends HttpSecurityBuilder<B>>

public final class OidcLogoutConfigurer.BackChannelLogoutConfigurer extends Object
A configurer for configuring OIDC Back-Channel Logout

## Constructor Summary

Constructors
Constructor
Description
`BackChannelLogoutConfigurer()`

## Method Summary

Modifier and Type
Method
Description
`OidcLogoutConfigurer<B>.BackChannelLogoutConfigurer`
`logoutHandler(org.springframework.security.web.authentication.logout.LogoutHandler logoutHandler)`
Configure what and how per-session logout will be performed.
`OidcLogoutConfigurer<B>.BackChannelLogoutConfigurer`
`logoutUri(String logoutUri)`
Use this endpoint when invoking a back-channel logout.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### BackChannelLogoutConfigurer

public BackChannelLogoutConfigurer()

## Method Details

### logoutUri

public OidcLogoutConfigurer<B>.BackChannelLogoutConfigurer logoutUri(String logoutUri)
Use this endpoint when invoking a back-channel logout.

The resulting `LogoutHandler` will `POST` the session cookie and CSRF token to this endpoint to invalidate the corresponding end-user session.

Supports URI templates like `{baseUrl}`, `{baseScheme}`, and `{basePort}`.

By default, the URI is set to `{baseScheme}://localhost{basePort}/logout`, meaning that the scheme and port of the original back-channel request is preserved, while the host and endpoint are changed.

If you are using Spring Security for the logout endpoint, the path part of this URI should match the value configured there.

Otherwise, this is handy in the event that your server configuration means that the scheme, server name, or port in the `Host` header are different from how you would address the same server internally.

Parameters:
  `logoutUri` - the URI to request logout on the back-channel
Returns:
  the `OidcLogoutConfigurer<B extends HttpSecurityBuilder<B>>.BackChannelLogoutConfigurer` for further customizations
Since:
  6.2.4

### logoutHandler

public OidcLogoutConfigurer<B>.BackChannelLogoutConfigurer logoutHandler(org.springframework.security.web.authentication.logout.LogoutHandler logoutHandler)
Configure what and how per-session logout will be performed.

This overrides any value given to `logoutUri(String)`

By default, the resulting `LogoutHandler` will `POST` the session cookie and OIDC logout token back to the original back-channel logout endpoint.

Using this method changes the underlying default that `POST`s the session cookie and CSRF token to your application's `/logout` endpoint. As such, it is recommended to call this instead of accepting the `/logout` default as this does not require any special CSRF configuration, even if you don't require other changes.

For example, configuring Back-Channel Logout in the following way:

            http
            .oidcLogout((oidc) -> oidc
                    .backChannel((backChannel) -> backChannel
                            .logoutHandler(new OidcBackChannelLogoutHandler())
                    )
            );

will make so that the per-session logout invocation no longer requires special CSRF configurations.

The default URI is `{baseUrl}/logout/connect/back-channel/{registrationId}`, which is simply an internal version of the same endpoint exposed to your Back-Channel services. You can use `OidcBackChannelLogoutHandler.setLogoutUri(String)` to alter the scheme, server name, or port in the `Host` header to accommodate how your application would address itself internally.

For example, if the way your application would internally call itself is on a different scheme and port than incoming traffic, you can configure the endpoint in the following way:

            http
                    .oidcLogout((oidc) -> oidc
                            .backChannel((backChannel) -> backChannel
                                    .logoutHandler("http://localhost:9000/logout/connect/back-channel/{registrationId}")
                            )
                    );

You can also publish it as a `@Bean` as follows:

            @Bean
            OidcBackChannelLogoutHandler oidcLogoutHandler(OidcSessionRegistry sessionRegistry) {
            OidcBackChannelLogoutHandler logoutHandler = new OidcBackChannelLogoutHandler(sessionRegistry);
            logoutHandler.setSessionCookieName("SESSION");
            return logoutHandler;
            }

to have the same effect.

Parameters:
  `logoutHandler` - the `LogoutHandler` to use each individual session
Returns:
  `OidcLogoutConfigurer<B extends HttpSecurityBuilder<B>>.BackChannelLogoutConfigurer` for further customizations
Since:
  6.4