title: Spring SAML - Is it mandatory to call SAML local logout when user signs off from application?
body: <p>As per the answer from the <a href="https://stackoverflow.com/questions/26356483/spring-saml-how-is-logout-handled-is-it-mandatory-to-have-logout-endpoint-in-i">link</a>, I understand that if SAML local logout (<code>/saml/logout?local=true</code>) is invoked Spring-SAML will clean the local cookies. So, I have modified the logout logic in my application to invoke it. </p>
  
  <p>All looks good till now. But my application have session timeout set to 20 minutes in web.xml. </p>
  
  <pre><code>&lt;session-config&gt;
          &lt;session-timeout&gt;20&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>In case of user inactive for 20 minutes or browser is closed by the user, session will be destroyed by the container silently. In that case SAML Logout is not invoked. </p>
  
  <p><strong>Questions:</strong> </p>
  
  <ol>
  <li>Does Spring-SAML maintains any references once user is authenticated after SAML response is received? </li>
  <li>If yes, where does it maintain references (session or somewhere else)? Any alternative way to clean them up?</li>
  <li>What are the implications if we do not call SAML local logout?</li>
  </ol>
  
  <p>My worry is that if the references are not cleaned up, It might cause memory leaks in a long run of the application. </p>