title: Problem to logout in java app with oauth2 and Google / Azure auth server
body: <p>I'm having a problem and I need some advice.
  The situation is the following, I have a very simple java module with spring security and a protected HTML page. The only thing this module does is authenticate against Google / Azure and if the credentials are correct it takes me to the HTML page. Implement OAuth2 and Spring security 5. Authentication works without problems, I get the idTokens, access token, and refresh token (in the case of Azure).
  The problem arises when trying to logout (button in HTML call to &quot;app/logogut&quot; URL). I see that what refers to the local security context is deleted, there are no cookies and there is nothing left in the browser's storage, however, the session on the external server (Google / Azure) is still active and when I refresh the page I am still logged in.
  If I open a new tab with Gmail, I enter directly without logging in and if I log out from Gmail, when I refresh the first tab now, it asks for the user and pass again. My query is if I am missing something for the logout to completely close the session through Spring security?</p>
  <p>Also, try to do a GET to the URL of each server to log out, that seems to work, but it would not be desirable to go that way -CORS Problem :(-.</p>
  <p>My security config</p>
  <p><a href="https://i.stack.imgur.com/tdLOf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tdLOf.png" alt="enter image description here" /></a></p>
  <p>In-text</p>
  <pre><code> @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .antMatchers(&quot;/&quot;, &quot;/login**&quot;).permitAll()
              .anyRequest().authenticated()
              .and()
              .logout()
              .logoutRequestMatcher(new AntPathRequestMatcher(&quot;/app/logout&quot;))
              .addLogoutHandler(new HeaderWriterLogoutHandler(
                      new ClearSiteDataHeaderWriter(
                              ClearSiteDataHeaderWriter.Directive.CACHE,
                              ClearSiteDataHeaderWriter.Directive.COOKIES,
                              ClearSiteDataHeaderWriter.Directive.STORAGE)))
              .and()
              .oauth2Login()
              .and().csrf().disable()
      ;
  }
  </code></pre>
  <p>My Controller</p>
  <pre><code> @Autowired
  @PreAuthorize(&quot;hasRole('ROLE_USER')&quot;)
  @GetMapping(&quot;/restricted&quot;)
  public String restricted() throws IOException, URISyntaxException {
      URL resource = getClass().getClassLoader().getResource(&quot;static\\Protected.html&quot;);
      if (resource == null) {
          throw new IllegalArgumentException(&quot;file not found!&quot;);
      } else {
  
          File html = new File(resource.toURI());
          List&lt;String&gt; strings = Files.readLines(html, StandardCharsets.UTF_8);
          StringBuffer sb = new StringBuffer();
          for (String s : strings) {
              sb.append(s);
          }
          return sb.toString();
  
  
      }
  
  }
  </code></pre>
  <p>HTML PAge</p>
  <p><a href="https://i.stack.imgur.com/wFjRM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wFjRM.png" alt="enter image description here" /></a></p>
  <p>Any help would be appreciated!</p>
  <p>Thanks in advance</p>