title: Spring Boot Security Logout Does Not Invalidate Session
body: <p>My enhanced Pet Clinic application requires security.</p>
  
  <p>Currently the logout functionality does not seem to work. I have a GET version (simple link) and a POST version (hidden form submitted by a link).</p>
  
  <p>After login, whichever method I use to log out, once I try to log in again, the new login is not allowed.</p>
  
  <p>I believe this is linked to this section:</p>
  
  <pre><code>.sessionManagement()
      .maximumSessions(1)
      .maxSessionsPreventsLogin(true)
      .expiredUrl("/login?expired")
  </code></pre>
  
  <p>but I thought that this section:</p>
  
  <pre><code>.logout()
      .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
      .logoutSuccessUrl("/")
      .permitAll()
  </code></pre>
  
  <p>would invalidate my <code>HttpSession</code> so that the next login would be allowed, but that is not happening.</p>
  
  <p>When I look at the logs, these are the lines that are different when I log in the 2nd time:</p>
  
  <pre><code>s.CompositeSessionAuthenticationStrategy : Delegating to org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy@2cc9f3de
  w.a.UsernamePasswordAuthenticationFilter : Authentication request failed: org.springframework.security.web.authentication.session.SessionAuthenticationException: Maximum sessions of 1 for this principal exceeded
  w.a.UsernamePasswordAuthenticationFilter : Updated SecurityContextHolder to contain null Authentication
  w.a.UsernamePasswordAuthenticationFilter : Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@16c670c3
  </code></pre>
  
  <p>.a.SimpleUrlAuthenticationFailureHandler : Redirecting to /login?error</p>
  
  <p>Any advice would be welcome.</p>
  
  <p>My application can be found at <a href="https://github.com/arnaldop/enhanced-pet-clinic" rel="nofollow">https://github.com/arnaldop/enhanced-pet-clinic</a>.</p>
  
  <p>Here's code from my <code>WebSecurityConfigurerAdapter</code> subclass:</p>
  
  <pre><code>private static final String[] UNSECURED_RESOURCE_LIST =
      new String[] {"/", "/resources/**", "/assets/**", "/css/**", "/webjars/**",
          "/images/**", "/dandelion-assets/**", "/unauthorized", "/error*"};
  
  @Override
  public void configure(WebSecurity web) throws Exception {
      web
          .ignoring()
              .antMatchers(UNSECURED_RESOURCE_LIST);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      //@formatter:off
      http
          .authorizeRequests()
              .antMatchers(UNSECURED_RESOURCE_LIST)
                  .permitAll()
              .antMatchers("/owners/**", "/vets/**", "/vets*").hasRole("USER")
              .antMatchers("/manage/**").hasRole("ADMIN")
              .anyRequest()
                  .permitAll()
          .and()
              .formLogin()
                  .loginPage("/login")
                      .failureUrl("/login?error")
                      .permitAll()
          .and()
              .logout()
                  .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                  .logoutSuccessUrl("/")
                  .permitAll()
          .and()
              .requiresChannel()
                  .antMatchers("/login", "/owners/**", "/vets/**", "/vets*", "/manage/**")
                      .requiresSecure()
          .and()
              .exceptionHandling()
                  .accessDeniedPage("/router?q=unauthorized")
          .and()
              .sessionManagement()
                  .maximumSessions(1)
                  .maxSessionsPreventsLogin(true)
                  .expiredUrl("/login?expired")
          ;
      //@formatter:on
  }
  </code></pre>