title: Implementing logout Rest API in Spring boot application
body: <p>I have the following Web security config for my spring boot app. </p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired 
      private AccountRepository accountRepository;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .authorizeRequests()
                  .antMatchers("/login").permitAll()
              .and()
              .authorizeRequests()
                  .antMatchers("/signup").permitAll()
              .and()
              .authorizeRequests()
                  .anyRequest().authenticated()
              .and()
                  .logout().logoutUrl("/logout").invalidateHttpSession(true)
              .and()
              // We filter the api/signup requests
              .addFilterBefore(
                  new JWTSignupFilter("/signup", authenticationManager(), accountRepository),
                  UsernamePasswordAuthenticationFilter.class)
              // We filter the api/login requests
              .addFilterBefore(
                  new JWTLoginFilter("/login", authenticationManager()),
                  UsernamePasswordAuthenticationFilter.class)
              // And filter other requests to check the presence of JWT in
              // header
              .addFilterBefore(new JWTAuthenticationFilter(userDetailsServiceBean()),
                  UsernamePasswordAuthenticationFilter.class);
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth)
              throws Exception {
          auth.userDetailsService(userDetailsServiceBean());
      }
  
      @Override
      public UserDetailsService userDetailsServiceBean() throws Exception {
          return new CustomUserDetailsService(accountRepository);
      }
  }
  </code></pre>
  
  <p>When a client makes a <code>POST</code> request to the <code>/logout</code> endpoint, the server throws an exception: </p>
  
  <pre><code>com.fasterxml.jackson.databind.JsonMappingException: No content to map due to end-of-input
   at [Source: org.apache.catalina.connector.CoyoteInputStream@3f636b5b; line: 1, column: 0]
      at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:270) ~[jackson-databind-2.8.7.jar:2.8.7]
      at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3838) ~[jackson-databind-2.8.7.jar:2.8.7]
      at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3783) ~[jackson-databind-2.8.7.jar:2.8.7]
      at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2908) ~[jackson-databind-2.8.7.jar:2.8.7]
      at com.boot.myapp.config.security.JWTLoginFilter.attemptAuthentication(JWTLoginFilter.java:32) ~[classes/:na]
  </code></pre>
  
  <p>as you can see, it tries to run a method in <code>JWTLoginFilter</code> which is used for logging in, but why ? </p>
  
  <p><strong>Edit 1</strong> </p>
  
  <p>Code for <code>JWTLoginFilter.java</code>:</p>
  
  <pre><code>public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter {
  
  
      public JWTLoginFilter(String url, AuthenticationManager authManager) {
          super(new AntPathRequestMatcher(url));
          setAuthenticationManager(authManager);
      }
  
      @Override
      public Authentication attemptAuthentication(HttpServletRequest req,
              HttpServletResponse res) throws AuthenticationException,
              IOException, ServletException {
  
          CustomUserDetails creds = new ObjectMapper().readValue(
                  req.getInputStream(), CustomUserDetails.class);
  
          return getAuthenticationManager().authenticate(
                  new UsernamePasswordAuthenticationToken(creds.getUsername(),
                          creds.getPassword()));
      }
  
      @Override
      protected void successfulAuthentication(HttpServletRequest req,
              HttpServletResponse res, FilterChain chain, Authentication auth) {
          TokenAuthenticationService.addAuthentication(res, auth.getName());
      }
  }
  </code></pre>