title: SecurityContextLogoutHandler clearing Authentication even if set to 'false'
body: <p>I'm currently trying to implement a logout mechanism for our application in Spring Boot 2 with Spring Security.</p>
  
  <p>My logout configuration for spring security is:</p>
  
  <pre><code>http
      .logout()
      .logoutRequestMatcher(new AntPathRequestMatcher("/logout.html"))
      .logoutSuccessHandler(logoutSuccessHandler)
      .addLogoutHandler(handler1)
      .addLogoutHandler(handler2)
      .clearAuthentication(false);
  </code></pre>
  
  <p>With this configuration Spring adds both handlers to the <code>LogoutFilter</code> along with Spring's own <code>SecurityContextLogoutHandler</code> as the last handler in the handler's chain.</p>
  
  <p>The problem we are facing is that in our custom <code>LogoutSuccessHandler</code> I need to have access to some variables stored in the <code>Authentication</code> in the security context but the context is cleared in the <code>SecurityContextLogoutHandler</code> even when the <code>.clearAuthentication(boolean clearAuthentication)</code> is set to <code>false</code>.</p>
  
  <p>What I really don't understand is the implementation of the <code>logout</code> method in <code>SecurityContextLogoutHandler</code>.</p>
  
  <pre><code>public void logout(HttpServletRequest request, HttpServletResponse response,
          Authentication authentication) {
      Assert.notNull(request, "HttpServletRequest required");
      if (invalidateHttpSession) {
          HttpSession session = request.getSession(false);
          if (session != null) {
              logger.debug("Invalidating session: " + session.getId());
              session.invalidate();
          }
      }
  
      if (clearAuthentication) {
          SecurityContext context = SecurityContextHolder.getContext();
          context.setAuthentication(null);
      }
  
      SecurityContextHolder.clearContext();
  }
  </code></pre>
  
  <p>Even when I set the <code>clearAuthentication</code> to false, it doesn't really matter because the last line of the method <code>SecurityContextHolder.clearContext();</code> will clear it anyway.</p>
  
  <p>What is the point of the <code>clearAuthentication</code> flag and how to retain the Authentication if I need to?</p>