Skip to content

Incorrect documentation for OIDC Back-Channel Logout #15198

Closed
@aelillie

Description

@aelillie

Describe the bug
https://docs.spring.io/spring-security/reference/servlet/oauth2/login/logout.html states that you need a way listen to events published by Spring Security to remove old OidcSessionInformation entries, like so:

@Bean
public HttpSessionEventListener sessionEventListener() {
    return new HttpSessionEventListener();
}

However HttpSessionEventListener.java does not exist. It took me a while to figure out that what you need instead is an HttpSessionEventPublisher like so:

@Bean
public HttpSessionEventPublisher httpSessionEventPublisher() {
    return new HttpSessionEventPublisher();
}

Please update the documentation :) Thank you.

Metadata

Metadata

Assignees

Labels

in: docsAn issue in Documentation or samplestype: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions