Spring security. How to log out user (revoke oauth2 token)

Question

When I want to get logout I invoke this code:

request.getSession().invalidate(); SecurityContextHolder.getContext().setAuthentication(null); 

But after it (in next request using old oauth token) I invoke

SecurityContextHolder.getContext().getAuthentication();

and I see my old user there.

How to fix it?

Answer 1

Here's my implementation (Spring OAuth2):

@Controller public class OAuthController {     @Autowired     private TokenStore tokenStore;      @RequestMapping(value = "/oauth/revoke-token", method = RequestMethod.GET)     @ResponseStatus(HttpStatus.OK)     public void logout(HttpServletRequest request) {         String authHeader = request.getHeader("Authorization");         if (authHeader != null) {             String tokenValue = authHeader.replace("Bearer", "").trim();             OAuth2AccessToken accessToken = tokenStore.readAccessToken(tokenValue);             tokenStore.removeAccessToken(accessToken);         }     } } 

For testing:

curl -X GET -H "Authorization: Bearer $TOKEN" http://localhost:8080/backend/oauth/revoke-token