LogoutPage.java

/**
 * Copyright 2014 55 Minutes (http://www.55minutes.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package fiftyfive.wicket.shiro.markup;

import fiftyfive.wicket.shiro.ShiroWicketPlugin;
import org.apache.shiro.SecurityUtils;
import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.request.flow.RedirectToUrlException;
import org.apache.wicket.request.mapper.parameter.PageParameters;
import org.apache.wicket.util.string.StringValue;

/**
 * This page is never rendered; it simply performs logout logic and redirects to the
 * home page or other URI as specified in the page parameters.
 * 
 * @author Matt Brictson
 * @since 3.0
 */
public class LogoutPage extends WebPage
{
    /**
     * Bookmarkable constructor. If a {@code "to"} parameter is provided, assume it is a URI
     * and redirect to that URI upon logout. Otherwise redirect to the home page.
     */
    public LogoutPage(PageParameters params)
    {
        super(params);
    }
    
    /**
     * Interrupt the rendering process and perform the logout, then redirect to a different page
     * by throwing an exception. The {@code LogoutPage} itself will therefore never be rendered.
     */
    @Override
    protected void onBeforeRender() throws RedirectToUrlException
    {
        logout();
        redirectAfterLogout();
    }
    
    /**
     * Called by {@link #onBeforeRender} to instruct Shiro to log the current user out, then
     * delegate to {@link ShiroWicketPlugin#onLoggedOut} to place a feedback message in the
     * session.
     */
    protected void logout()
    {
        // Perform Shiro logout
        SecurityUtils.getSubject().logout();
        
        // Delegate to plugin to perform any futher logout tasks
        ShiroWicketPlugin.get().onLoggedOut();
    }
    
    /**
     * Called by {@link #onBeforeRender} after {@link #logout} to redirect to another page.
     * By default this is the application home page. However if a {@code "to"} page parameter
     * was provided, assume it is a URI and redirect to that URI instead. For security reasons,
     * full URLs (i.e. something starting with {@code http}) are ignored.
     *
     * @throws RedirectToUrlException to cause Wicket to perform a 302 redirect
     */
    protected void redirectAfterLogout() throws RedirectToUrlException
    {
        StringValue to = getPageParameters().get("to");
        
        // If "to" param was not specified, or was erroneously set to
        // an absolute URL (i.e. containing a ":" like "http://blah"), then fall back
        // to the home page.
        if(null == to || to.isNull() || to.toString().indexOf(":") >= 0)
        {
            to = StringValue.valueOf(urlFor(getApplication().getHomePage(), null));
        }
        
        throw new RedirectToUrlException(to.toString(), 302);
    }
}