spring security的logout功能出现404

查看HttpSecurity的logout().logoutUrl()的API

The URL that triggers log out to occur (default is "/logout"). If CSRF protection is enabled (default), then the request must also be a POST. This means that by default POST "/logout" is required to trigger a log out. If CSRF protection is disabled, then any HTTP method is allowed. 
It is considered best practice to use an HTTP POST on any action that changes state (i.e. log out) to protect against CSRF attacks. If you really want to use an HTTP GET, you can use logoutRequestMatcher(new AntPathRequestMatcher(logoutUrl, "GET"));

上面说:默认情况下”/logout”必须使用POST提交才可以起作用
原因:CSRS功能默认开启了

CSRF功能是否开启:

1)开启:使用POST提交,注意token了

<form action="${pageContext.request.contextPath }/logout" method="post">
    <input type="hidden" name="${_csrf.parameterName }" value="${_csrf.token }"/>
    <input type="submit" value="logout">
</form>

2)没有开启:

需要手动关闭csrf功能:
使用HTTPSecurity的csrf().disable();关闭
此时既可以使用Get方法也可以使用Post方法提交

在CSRF功能开启的情况下使用GET 去logout

该方法为HTTPSecurity的方法
logoutRequestMatcher(new AntPathRequestMatcher(logoutUrl, “GET”))
此时指定了提交方法去限制logout