public class

JiraLogoutServlet

extends HttpServlet
java.lang.Object
   ↳ javax.servlet.GenericServlet
     ↳ javax.servlet.http.HttpServlet
       ↳ com.atlassian.jira.security.login.JiraLogoutServlet

Class Overview

Responsible for processing log-out requests.
It performs an XSRF check and delegates to the underlying Seraph log-out servlet.

See Also
  • com.atlassian.seraph.logout.LogoutServlet

Summary

Public Constructors
JiraLogoutServlet()
Public Methods
void destroy()
ServletConfig getServletConfig()
void init()
void init(ServletConfig servletConfig)
Protected Methods
void service(HttpServletRequest request, HttpServletResponse response)

Processes a request to log-out a User.

[Expand]
Inherited Methods
From class javax.servlet.http.HttpServlet
From class javax.servlet.GenericServlet
From class java.lang.Object
From interface javax.servlet.Servlet
From interface javax.servlet.ServletConfig

Public Constructors

public JiraLogoutServlet ()

Public Methods

public void destroy ()

public ServletConfig getServletConfig ()

public void init ()

Throws
ServletException

public void init (ServletConfig servletConfig)

Throws
ServletException

Protected Methods

protected void service (HttpServletRequest request, HttpServletResponse response)

Processes a request to log-out a User. If there's a valid XSRF token, it delegates to the underlying Seraph log-out servlet.

Otherwise, it is possible that the XSRF token has expired (due to a session timeout), or that this is a dodgy token.

When the session times out, there are users who have remember me or Crowd SSO turned on and they will be authenticated. We need to confirm that they are who they say they are in order to perform a log-out, this is because we need to perform clean-up operations for them (e.g removing the remember me cookie, we don't want attacker to trick you into deleting your own remember me cookie).

On the other hand, if there's no authenticated user and the session is gone, we tell the user that he's already logged out.

Parameters
request The request in play.
response The response in play.
Throws
ServletException
IOException
ServletException