title: Spring Security logout does not work - does not clear security context and authenticated user still exists
body: <p>I know, there are many articles about this topic, but I have a problem and I can't find any solution.</p>
  
  <p>I have a classic spring security java config:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  private AuctionAuthenticationProvider auctionAuthenticationProvider;
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(auctionAuthenticationProvider);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.httpBasic();
  
      ExpressionUrlAuthorizationConfigurer&lt;HttpSecurity&gt;.ExpressionInterceptUrlRegistry authorizeRequest = http.authorizeRequests();
  
      configureAdminPanelAccess(authorizeRequest);
      configureFrontApplicationAccess(authorizeRequest);
      configureCommonAccess(authorizeRequest);
  
      http.csrf()
          .csrfTokenRepository(csrfTokenRepository()).and()
          .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
  
      http.logout()
          .clearAuthentication(true)
          .invalidateHttpSession(true);
  }
  ...
  }
  </code></pre>
  
  <p>Also, I have two controller methods, where I login/logout from my web application by AJAX.</p>
  
  <p>When I would like to logout, I first call this method, which I expect to clear user sessions and clear everything from the security context.</p>
  
  <pre><code>@Override
  @RequestMapping(value = "/logout", method = GET, produces = APPLICATION_JSON_UTF8_VALUE)
  public ResponseEntity&lt;Boolean&gt; logout(final HttpServletRequest request, final HttpServletResponse response) {
      Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      if (auth != null){
          new SecurityContextLogoutHandler().logout(request, response, auth);
      }
  
      return new ResponseEntity&lt;&gt;(Boolean.TRUE, HttpStatus.OK);
  }
  </code></pre>
  
  <p>After this I reload my client web application and each time, when it is reloaded, I check whether the user is authenticated by calling the following controller method:</p>
  
  <pre><code>@Override
  @RequestMapping(value = "/user", method = GET, produces = APPLICATION_JSON_UTF8_VALUE)
  public ResponseEntity&lt;UserDetails&gt; user() {
      Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
      if (principal instanceof UserDetails) {
          return new ResponseEntity&lt;&gt;((UserDetails) principal, HttpStatus.OK);
      }
  
      return null;
  }
  </code></pre>
  
  <p>And here I aways receive the last authenticated user. It seems that in the previous logout method, Spring logout doesn't work.</p>
  
  <p>Keep in mind that I tried to logout with the following code, without any success:</p>
  
  <pre><code>   @Override
     @RequestMapping(value = "/logout", method = GET, produces = APPLICATION_JSON_UTF8_VALUE)
      public ResponseEntity&lt;Boolean&gt; logout(final HttpServletRequest request) {
       try {
           request.logout();
  
           return new ResponseEntity&lt;&gt;(Boolean.TRUE, HttpStatus.OK);
       } catch (ServletException ex) {
           if (LOG.isDebugEnabled()) {
               LOG.debug("There is a problem with the logout of the user", ex);
           }
      }
  </code></pre>
  
  <p>Are you have any idea what I miss in my config and the logout process?</p>