title: How to pass parameter along with logout success url in spring security?
body: <p>I am using java based spring security configuration in my spring boot application. When user clicks on logout link, user is redirected to the login page. Here, in this case, I need to pass a custom parameter in the logout success url. </p>
  
  <p>e.g. when I logout, app is redirected to <a href="http://localhost:8080/app/login" rel="nofollow">http://localhost:8080/app/login</a>
  But I want it to have a parameter like below
  <a href="http://localhost:8080/app/login?idletimeout=true" rel="nofollow">http://localhost:8080/app/login?idletimeout=true</a></p>
  
  <p>I have created my custom LogoutSuccesshandle for this. I get the param value in the handler and then I construct the success url and then redirect to it. But then on logout that parameter goes missing.</p>
  
  <p>Below is my handler code. </p>
  
  <pre><code>public class LogoutSuccessHandlerImpl extends SimpleUrlLogoutSuccessHandler {
  
      private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
  
      @Override
      public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  
          request.getSession().invalidate();
          SecurityContextHolder.clearContext();
  
          request.setAttribute("isLoggedOut", "true");
  
          String contextPath = request.getContextPath();
          String redirectURL = "/login";
  
          String isIdleTimeOut = request.getParameter("idleTimeout");
          request.setAttribute("idleTimeout", isIdleTimeOut);
  
          System.out.println(isIdleTimeOut + " isIdleTimeOut ");
  
          if (isIdleTimeOut != null &amp;&amp; isIdleTimeOut.equalsIgnoreCase("true")) {
              System.out.println("in if ");
              redirectURL += "?idleTimeout=" + isIdleTimeOut;
          }
  
          // setDefaultTargetUrl(redirectURL);
          // response.sendRedirect(redirectURL);
         // super.onLogoutSuccess(request, response, authentication);
          redirectStrategy.sendRedirect(request, response, redirectURL);
      }
  </code></pre>
  
  <p>Below is my java config code. </p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf()
          .and()
              .formLogin()
              .loginPage("/login")
              .loginProcessingUrl("/checkLogin")
              .defaultSuccessUrl("/home")
              .failureUrl("/login?login_error=1")
              .usernameParameter("username")
              .passwordParameter("password")
              .permitAll()
          .and()
              .logout()
              .logoutUrl("/logout")
              .logoutSuccessHandler(new LogoutSuccessHandlerImpl())
              .deleteCookies("JSESSIONID")
              .invalidateHttpSession(true)
              .permitAll()
          .and()
              .authorizeRequests()
              .antMatchers("/login**").permitAll()
              .antMatchers("/error**").permitAll()
              .antMatchers("/checkLogin**").permitAll()
              .anyRequest()
              .authenticated()
              .accessDecisionManager(accessDecisionManager)
          .and()
              .exceptionHandling()
              .accessDeniedPage("/accessDenied")
          .and()
              .headers()
              .frameOptions()
              .disable()
          .and()
              .sessionManagement()
              .invalidSessionUrl("/login")
              .maximumSessions(1);
      }
  </code></pre>