Spring Security 3.2.0RC2 logout url POST only?

Question

I am experimenting with Spring Security 3.2.0.RC2 using javaconfig and it appears that the logout url is POST only. Is this by design and is there any way to make it logout a user with a GET request?

protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/resources/**", "/signup", "/about", "/password").permitAll()                  
        .antMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated().and()
        .formLogin()
            .loginPage("/login")
            .permitAll();        
}

Answer 1

This is intentional and is documented within the CSRF documentation. The reason is to prevent CSRF attacks that forcibly log users out of your application. If you would like to support non-POST requests you can do so with the following Java Configuration:

protected void configure(HttpSecurity http) throws Exception {
  http
    // ...
    .logout()
       .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
}

You can also find information about configuring log out on the Javadoc of the LogoutConfigurer (i.e. the object returned by the http.logout() method).