How Spring Security’s Logout Form Worked Without a Controller

While working on a web application secured with Spring Security, I stumbled upon something intriguing: a simple <form> tag for logging out worked flawlessly, even though no custom controller was written for it. Curiosity got the better of me, and I dove into the configuration to figure out why.

Setup

Thymeleaf

Clicking the “Logout” button logged the user out and redirected to the homepage. But something puzzled me: where was the controller handling this? Why did it work without any extra code?

Uncovering Spring Security’s Logout Magic

The answer lay in Spring Security’s built-in logout handling. By default, Spring Security provides a /logout endpoint that responds to POST requests. When triggered, it:

1. Clears the session: The user is logged out by invalidating their session.
2. Redirects to a specified URL: After logout, the browser navigates to a predefined URL.

This line instructs Spring Security to redirect to the homepage (/) after a successful logout. That was the first clue—no custom controller was needed because Spring Security was handling everything.

Connecting the Dots with the <form> Tag

The Thymeleaf form started to make sense:

Here’s what happens when the form is submitted:

• The /logout Endpoint: The th:action="@{/logout}" targets Spring Security’s built-in /logout endpoint. Submitting the form sends a POST request to this URL.
• Spring Security’s Role: Spring Security intercepts the request, processes the logout by clearing the session, and redirects to the homepage, as specified by .logoutSuccessUrl("/").
• No Controller Needed: Since Spring Security manages the entire process, there’s no need for a @PostMapping("/logout") endpoint or custom logic.

It felt like Spring Security was quietly doing all the heavy lifting, leaving me free to focus on other parts of the app.