Question

I was wondering how to the remove the remember me cookie when using spring remember me services. I am using the default remember me cookie name I came across the following documentation in spring to delete the JSESSION.

    <http>
      <logout delete-cookies="JSESSIONID" />
    </http>

But is it possible to do something like below to delete the remember me cookie as well

I don't have a logout controller and i have the following configuration in the spring xml.

  <http use-expressions="true">
    <!-- Authentication policy -->
    <form-login login-page="/signin" login-processing-url="/signin/authenticate" authentication-failure-url="/signin?param.error=bad_credentials" />
    <logout logout-url="/signout" delete-cookies="JSESSIONID" />
            ....................
Was it helpful?

Solution

I don't think you have to manually delete the remember-me cookie. The AbstractRememberMeServices implements the LogoutHandler interface, so it will receive a call-back from the LogoutFilter, and makes sure the remember-me cookie is cancelled on logout.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top