question: @ Override public void logout ( HttpServletRequest request , HttpServletResponse response , Authentication authentication ) { String rememberMeCookie = extractRememberMeCookie ( request ) ; if ( rememberMeCookie != null && rememberMeCookie . length ( ) != 0 ) { try { String [ ] cookieTokens = decodeCookie ( rememberMeCookie ) ; if ( cookieTokens . length != 2 ) { throw new InvalidCookieException ( "Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays . asList ( cookieTokens ) + "'" ) ; } persistentTokenRepository . deleteById ( cookieTokens [ 0 ] ) ; } catch ( InvalidCookieException ice ) { log . info ( "Invalid cookie, no persistent token could be deleted" ) ; } catch ( RememberMeAuthenticationException rmae ) { log . debug ( "No persistent token found, so no token could be deleted" ) ; } } super . logout ( request , response , authentication ) ; }
target:  When logout occurs, only invalidate the current token, and not all user sessions. <p/> The standard Spring Security implementations are too basic: they invalidate all tokens for the current user, so when he logs out from one browser, all his other sessions are destroyed.