{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-session/issues/375","repository_url":"https://api.github.com/repos/spring-projects/spring-session","labels_url":"https://api.github.com/repos/spring-projects/spring-session/issues/375/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-session/issues/375/comments","events_url":"https://api.github.com/repos/spring-projects/spring-session/issues/375/events","html_url":"https://github.com/spring-projects/spring-session/issues/375","id":135445475,"number":375,"title":"Logout and InvalidSessionStrategy","user":{"login":"rscipien","id":11942504,"avatar_url":"https://avatars.githubusercontent.com/u/11942504?v=3","gravatar_id":"","url":"https://api.github.com/users/rscipien","html_url":"https://github.com/rscipien","followers_url":"https://api.github.com/users/rscipien/followers","following_url":"https://api.github.com/users/rscipien/following{/other_user}","gists_url":"https://api.github.com/users/rscipien/gists{/gist_id}","starred_url":"https://api.github.com/users/rscipien/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rscipien/subscriptions","organizations_url":"https://api.github.com/users/rscipien/orgs","repos_url":"https://api.github.com/users/rscipien/repos","events_url":"https://api.github.com/users/rscipien/events{/privacy}","received_events_url":"https://api.github.com/users/rscipien/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-22T15:05:53Z","updated_at":"2016-02-22T15:05:53Z","closed_at":null,"body":"I have problem during logout when I have set invalid session url.\r\n```Java\r\nsessionManagement()\r\n.invalidSessionUrl(\"/login?sessionExpired\");\r\n```\r\nSpring goes to Logout filter invalidate session and then in SessionManagerFilter check it session is valid. In that moment request point to login?logout but goes to invalidSessionStrategy and change that to login?sessionExpired. Maybe in SimpleRedirectInvalidSessionStrategy there should be some check if that url have set permitAll() and don't redirect\r\n```Java\r\n  public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException {\r\n        logger.debug(\"Starting new session (if required) and redirecting to '\" + destinationUrl + \"'\");\r\n        if (createNewSession) {\r\n            request.getSession();\r\n        }\r\n       // some check hier ???\r\n        redirectStrategy.sendRedirect(request, response, destinationUrl);\r\n    }\r\n\r\n```\r\nThere is parameter to don't invalidate session in logout config but what are the security consensuses of not invalidating it ? There was probably a reason what it is by default turn on.\r\n``` Java\r\n.logout()\r\n.invalidateHttpSession(false)\r\n```"}}