Question

I have a Spring MVC project which uses Spring Security. I am wondering how j_spring_security_logout works. I have a logout link defined in a view like this:

<a href="<c:url value="/j_spring_security_logout" />">Logout</a> 

In my spring-security.xml I have defined this:

<form-login login-page="/login" default-target-url="/wellcome" authentication-failure-url="/loginfailed"  />
<logout logout-success-url="/logout" logout-url="/j_spring_security_logout" />
<session-management invalid-session-url="/invalidsession" />

I expected that clicking logout should redirect me to /logout, but instead I get redirected to the invalid-session-url, namely /invalidsession. The logout-success-url is ignored.

However when I delete session-management, logging out does indeed redirect me to /logout.

Answer 1

This is explained in the Spring Security reference manual.

You can’t really use the session-expiry facility unless the session cookie is deleted when you log out.