@Override public void logout(HttpServletRequest request,HttpServletResponse response,Authentication authentication){
  String rememberMeCookie=extractRememberMeCookie(request);
  if (rememberMeCookie != null && rememberMeCookie.length() != 0) {
    try {
      String[] cookieTokens=decodeCookie(rememberMeCookie);
      if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '"+ Arrays.asList(cookieTokens)+ "'");
      }
      persistentTokenRepository.deleteById(cookieTokens[0]);
    }
 catch (    InvalidCookieException ice) {
      log.info("Invalid cookie, no persistent token could be deleted");
    }
catch (    RememberMeAuthenticationException rmae) {
      log.debug("No persistent token found, so no token could be deleted");
    }
  }
  super.logout(request,response,authentication);
}

@ Override public void logout ( HttpServletRequest request , HttpServletResponse response , Authentication authentication ) { String rememberMeCookie = extractRememberMeCookie ( request ) ; if ( rememberMeCookie != null && rememberMeCookie . length ( ) != 0 ) { try { String [ ] cookieTokens = decodeCookie ( rememberMeCookie ) ; if ( cookieTokens . length != 2 ) { throw new InvalidCookieException ( "Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays . asList ( cookieTokens ) + "'" ) ; } persistentTokenRepository . deleteById ( cookieTokens [ 0 ] ) ; } catch ( InvalidCookieException ice ) { log . info ( "Invalid cookie, no persistent token could be deleted" ) ; } catch ( RememberMeAuthenticationException rmae ) { log . debug ( "No persistent token found, so no token could be deleted" ) ; } } super . logout ( request , response , authentication ) ; }
when logout occurs , only invalidate the current token , and not all user sessions . < p / > the standard spring security implementations are too basic : they invalidate all tokens for the current user , so when he logs out from one browser , all his other sessions are destroyed .
