title: Spring security session destroy
body: <p>Can anybody give me a spring security namespace configuration for session destroy after logging out? its seems mine doesnt work, and i dnno why.</p>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;security:global-method-security
      secured-annotations="enabled" /&gt;
  &lt;security:http auto-config="true" use-expressions="true"&gt;
      &lt;security:csrf disabled="true" /&gt;
      &lt;security:intercept-url pattern="/selectRolePage"
          access="hasAnyRole('ROLE_AUTHOR','ROLE_ADMIN','ROLE_EDITOR',
          'ROLE_EDITOR_IN_CHIEF','ROLE_REVIEWER','ROLE_PROOFREADER','ROLE_TECHNICAL_EDITOR')" /&gt;
      &lt;security:intercept-url pattern="/author"
          access="hasRole('ROLE_AUTHOR')" /&gt;
      &lt;security:intercept-url pattern="/editor"
          access="hasRole('ROLE_EDITOR')" /&gt;
      &lt;security:intercept-url pattern="/editorinchief"
          access="hasRole('ROLE_EDITOR_IN_CHIEF')" /&gt;
      &lt;security:intercept-url pattern="/reviewer"
          access="hasRole('ROLE_REVIEWER')" /&gt;
      &lt;security:intercept-url pattern="/proofreader"
          access="hasRole('ROLE_PROOFREADER')" /&gt;
      &lt;security:intercept-url pattern="/admin"
          access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;security:intercept-url pattern="/technicaleditor"
          access="hasRole('ROLE_TECHNICAL_EDITOR')" /&gt;
      &lt;security:form-login login-page="/login-page" login-processing-url="/login"
          default-target-url="/selectRolePage" /&gt;
      &lt;security:logout logout-url="/logout" logout-success-url="/login-page" invalidate-session="true" delete-cookies="JSESSIONID" /&gt;
  
  
  &lt;/security:http&gt;
  
  &lt;!-- &lt;security:authentication-manager&gt; --&gt;
  &lt;!-- &lt;security:authentication-provider&gt; --&gt;
  &lt;!-- &lt;security:user-service&gt; --&gt;
  &lt;!-- &lt;security:user name="jimi" password="jimispassword" --&gt;
  &lt;!-- authorities="ROLE_AUTHOR, ROLE_ADMIN" /&gt; --&gt;
  &lt;!-- &lt;security:user name="bob" password="bobspassword" --&gt;
  &lt;!-- authorities="ROLE_AUTHOR" /&gt; --&gt;
  &lt;!-- &lt;security:user name="hirannor" password="hirannorspassword" --&gt;
  &lt;!-- authorities="ROLE_AUTHOR, ROLE_ADMIN, ROLE_EDITOR_IN_CHIEF" /&gt; --&gt;
  &lt;!-- &lt;/security:user-service&gt; --&gt;
  &lt;!-- &lt;/security:authentication-provider&gt; --&gt;
  &lt;!-- &lt;/security:authentication-manager&gt; --&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider&gt;
          &lt;security:jdbc-user-service
              data-source-ref="dataSource"
              users-by-username-query="select username,password, enabled from users where username=?"
              authorities-by-username-query="select username, role from user_roles where username =? " /&gt;
          &lt;security:password-encoder hash="bcrypt" /&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="encoder"
      class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
      &lt;constructor-arg name="strength" value="10" /&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p></p>
  
  <pre><code>&lt;li&gt;&lt;a href="/web/logout" &gt;&lt;i
                              class="fa fa-sign-out fa-fw"&gt;&lt;/i&gt; Logout&lt;/a&gt;&lt;/li&gt;
  </code></pre>
  
  <p>Its redirect me to the /web/login-page,but i still got the JSESSIONID</p>