Package org.springframework.security.web.authentication.logout

# Class SecurityContextLogoutHandler

java.lang.Object
org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler

All Implemented Interfaces:
  `LogoutHandler`

public class SecurityContextLogoutHandler extends Object implements LogoutHandler
Performs a logout by modifying the `SecurityContextHolder`.

Will also invalidate the `HttpSession` if `isInvalidateHttpSession()` is `true` and the session is not `null`.

Will also remove the `Authentication` from the current `SecurityContext` if `clearAuthentication` is set to true (default).

## Field Summary

Fields
Modifier and Type
Field
Description
`protected final org.apache.commons.logging.Log`
`logger`

## Constructor Summary

Constructors
Constructor
Description
`SecurityContextLogoutHandler()`

## Method Summary

Modifier and Type
Method
Description
`boolean`
`isInvalidateHttpSession()`
`void`
`logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)`
Requires the request to be passed in.
`void`
`setClearAuthentication(boolean clearAuthentication)`
If true, removes the `Authentication` from the `SecurityContext` to prevent issues with concurrent requests.
`void`
`setInvalidateHttpSession(boolean invalidateHttpSession)`
Causes the `HttpSession` to be invalidated when this `LogoutHandler` is invoked.
`void`
`setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)`
Sets the `SecurityContextHolderStrategy` to use.
`void`
`setSecurityContextRepository(SecurityContextRepository securityContextRepository)`
Sets the `SecurityContextRepository` to use.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### logger

protected final org.apache.commons.logging.Log logger

## Constructor Details

### SecurityContextLogoutHandler

public SecurityContextLogoutHandler()

## Method Details

### logout

public void logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)
Requires the request to be passed in.

Specified by:
  `logout` in interface `LogoutHandler`
Parameters:
  `request` - from which to obtain a HTTP session (cannot be null)
  `response` - not used (can be `null`)
  `authentication` - not used (can be `null`)

### isInvalidateHttpSession

public boolean isInvalidateHttpSession()

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8

### setInvalidateHttpSession

public void setInvalidateHttpSession(boolean invalidateHttpSession)
Causes the `HttpSession` to be invalidated when this `LogoutHandler` is invoked. Defaults to true.

Parameters:
  `invalidateHttpSession` - true if you wish the session to be invalidated (default) or false if it should not be.

### setClearAuthentication

public void setClearAuthentication(boolean clearAuthentication)
If true, removes the `Authentication` from the `SecurityContext` to prevent issues with concurrent requests.

Parameters:
  `clearAuthentication` - true if you wish to clear the `Authentication` from the `SecurityContext` (default) or false if the `Authentication` should not be removed.

### setSecurityContextRepository

public void setSecurityContextRepository(SecurityContextRepository securityContextRepository)
Sets the `SecurityContextRepository` to use. Default is `HttpSessionSecurityContextRepository`.

Parameters:
  `securityContextRepository` - the `SecurityContextRepository` to use.