title: Spring CSRF override "POST" logout behaviour in security XML config
body: <p>Currently we have a problem with Spring CSRF  solution for our legacy App because CSRF implementation changes behavior of default Spring security 
  Spring security configuration sis following:</p>
  
  <pre><code>&lt;http pattern=""&gt;
  ...
  &lt;logout
                  logout-url="/logout"
                  delete-cookies="..."
                  success-handler-ref="logoutSuccessHandler"
                  /&gt;
  &lt;csrf/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p><code>org.springframework.security.config.annotation.web.configurers.LogoutConfigurer</code> Logout configurer.
  According to Spring documentation:</p>
  
  <blockquote>
    <p>Adding CSRF will update the LogoutFilter to only use HTTP POST. This
    ensures that log out requires a CSRF token and that a malicious user
    cannot forcibly log out your users.</p>
  </blockquote>
  
  <p>Code that makes this change is the following:</p>
  
  <pre><code> private RequestMatcher getLogoutRequestMatcher(H http) {
          if(logoutRequestMatcher != null) {
              return logoutRequestMatcher;
          }
          if(http.getConfigurer(CsrfConfigurer.class) != null) {
              this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl, "POST");
          } else {
              this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl);
          }
          return this.logoutRequestMatcher;
      }
  </code></pre>
  
  <p>Generally for CSRF protection such behavior makes perfect sense. But as for me it's very strange that this implementation is not flexible (why hardcode real implementations and not autowire dependencies?).</p>
  
  <p>The problem is that our application is built in such way that before regular Spring logout it's performed additional clean up in Spring Controllers. Mainly it was implemented <a href="http://docs.spring.io/autorepo/docs/spring-security/3.1.7.RELEASE/apidocs/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.html">Switch User</a>feature but in a custom way. So, changing logout link to perform POST is not an option because mainly clean up is performed on custom Controller.</p>
  
  <p>It seems in order to use specified approach there is only one possible solution:</p>
  
  <pre><code>@RequestMapping(value = "/logout", method = RequestMethod.GET) //or it can be a post
      public String logout() {
  // 1. Perform Clean up
  // 2. Decide whether to logout or redirect to other page
  // 3. Perform redirect based on decision
  }
  </code></pre>
  
  <p>//If it's decided to logout this will go to this Controller method:</p>
  
  <pre><code>  @RequestMapping(value = "csrflogout", method = RequestMethod.GET)
      public void csrfLogout(){
  //1 Create manual post request
  //2. Copy session information
  //3. Perform Post to logout URL that is specified in security xml
       }
  </code></pre>
  
  <p>Generally this approach is not good from code quality perspective.
  So, there are two questions:</p>
  
  <ol>
  <li>What is the reason to make such strict implementation in Spring and don't provide any visible possibility to override it (specifically I provided code example how it's created )?</li>
  <li>Any good alternative to fix mentioned problem. </li>
  </ol>