title: Spring-Security with /j_spring_security_logout possibly not logging out fully
body: <p>So I am trying to determine if this is a bug or browser caching or if I am missing something, but when I log out I can access any page that I have previously accessed before.  I even have an ajax call to a rest endpoint and when I call that I print the response and get a 200 ok.  </p>
  
  <p>Now if I click logout it returns to the login page with the invalid session url params.  So it looks like it is attempting to remove the session, plus if I close the browser fully, not just the tab I can no longer access the pages I was able to access before.  But if I don't close the browser I can access any pages that I have already accessed, pages I have not accessed yet forward me to the login page.  It makes me wonder if its a browser cache issue, but the 200ok on the ajax request makes me doubt that.  </p>
  
  <p>Spring-Security version 3.1.0</p>
  
  <p>Here is my configuration for the logout.</p>
  
  <pre><code>&lt;logout invalidate-session="true" logout-success-url="/login-page.html?logout=true"
          logout-url="/j_spring_security_logout" /&gt;
      &lt;session-management invalid-session-url="/login-page.html?session=invalid"&gt;
          &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
      &lt;/session-management&gt;
  </code></pre>
  
  <p>in the web.xml i have added this listener</p>
  
  <pre><code>&lt;listener&gt;
      &lt;listener-class&gt;org.springframework.security.web.session.HttpSessionEventPublisher&lt;/listener-class&gt;
  &lt;/listener&gt;
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>It was indeed a browser cache issue, so to fix it I added to the DispatcherServlet xml</p>
  
  <pre><code>&lt;bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter"&gt;
       &lt;property name="cacheSeconds" value="0" /&gt;
   &lt;/bean&gt;
  </code></pre>
  
  <p>Also added the META tags to head</p>
  
  <pre><code>&lt;meta http-equiv="Pragma" content="no-cache"&gt;
  &lt;meta http-equiv="Expires" content="-1"&gt;
  </code></pre>
  
  <p>This now disables caching for all my pages and rest methods.</p>