Skip to content

Commit

Permalink
Fix the problem of accessing logout page without authentication (#6812)
Browse files Browse the repository at this point in the history
#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

Currently, logout page is always visible for anyone whether the user is authenticated. This PR restricts the visibility of logout page to authenticated users but anonymous users.

#### Special notes for your reviewer:

```bash
> http http://localhost:8090/logout

HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: 0
Location: /login?authentication_required
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-length: 0
```

#### Does this PR introduce a user-facing change?

```release-note
修复未登录情况下依然能够访问登出页面的问题
```
  • Loading branch information
JohnNiang authored Oct 10, 2024
1 parent 9e3f77b commit cae871f
Showing 1 changed file with 6 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -59,8 +59,7 @@ SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
"/login/**",
"/challenges/**",
"/password-reset/**",
"/signup",
"/logout"
"/signup"
).permitAll());
}

Expand All @@ -69,7 +68,11 @@ SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
SecurityConfigurer authenticatedAuthorizationConfigurer() {
// Anonymous user is not allowed
return http -> http.authorizeExchange(
spec -> spec.pathMatchers("/console/**", "/uc/**").authenticated()
spec -> spec.pathMatchers(
"/console/**",
"/uc/**",
"/logout"
).authenticated()
);
}

Expand Down

0 comments on commit cae871f

Please sign in to comment.