LOGOUT_URL does not consider server.servlet.context-path

[simasch]

When setting the server.servlet.context-path the logout URL will be wrong.

One way could be to use it in the code

@EnableWebSecurity
@Configuration
public class SecurityConfiguration extends VaadinWebSecurityConfigurerAdapter {

    private final String logoutUrl;

    public SecurityConfiguration(@Value("${server.servlet.context-path:/}") String logoutUrl) {
        this.logoutUrl = logoutUrl;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        super.configure(http);
        setLoginView(http, LoginView.class, logoutUrl);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        super.configure(web);
        web.ignoring().antMatchers("/images/*.png");
    }
}

@Component
public class AuthenticatedUser {

   private final UserRepository userRepository;
   private final String logoutUrl;

   @Autowired
   public AuthenticatedUser(UserRepository userRepository, @Value("${server.servlet.context-path:/}") String logoutUrl) {
       this.userRepository = userRepository;
       this.logoutUrl = logoutUrl;
   }

   private Optional<Authentication> getAuthentication() {
       SecurityContext context = SecurityContextHolder.getContext();
       return Optional.ofNullable(context.getAuthentication())
               .filter(authentication -> !(authentication instanceof AnonymousAuthenticationToken));
   }

   public Optional<User> get() {
       return getAuthentication().map(authentication -> userRepository.findByUsername(authentication.getName()));
   }

   public void logout() {
       UI.getCurrent().getPage().setLocation(logoutUrl);
       SecurityContextLogoutHandler logoutHandler = new SecurityContextLogoutHandler();
       logoutHandler.logout(VaadinServletRequest.getCurrent().getHttpServletRequest(), null, null);
   }

}

[Artur-]

I think this should be moved to the Flow repository and handled automatically by the default security config. There is nothing here that is app specific, right?

With the new component based security config added in vaadin/flow#14303 it should also be possible the inject it into AuthenticatedUser and reuse the logout url defined there

[Artur-]

start.vaadin.com now uses the default logout URL and once vaadin/flow#15532 is in a release, it will use the context path correctly

[ghe-bm]

Could you please backport this fix to Vaadin 23?