title: Why does /login?logout redirect to /login?
body: <p>In my Spring project, I set the logout target url to "/login?logout" to display the login page with a message "You are now logged out".</p>
  
  <p>In the Spring Security config, I did this :</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .csrf().disable()
              .authorizeRequests()
              .antMatchers("/error").permitAll()
              .anyRequest().fullyAuthenticated()
              .and()
              .formLogin()
              .loginPage("/login")
              .permitAll()
              .successHandler(loginSuccessHandler)
              .failureUrl("/login?error")
              .and()
              .httpBasic()
              .and()
              .logout()
              .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
              .permitAll()
              .logoutSuccessHandler(logoutSuccessHandler);
  }
  </code></pre>
  
  <p>And the logoutSuccessHandler :</p>
  
  <pre><code>public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
          Authentication authentication) throws IOException, ServletException {
  
      if (authentication != null) {
          Log.debug(authentication.getName() + " LOGOUT !!");
      }
  
      setDefaultTargetUrl("/login?logout");
      super.onLogoutSuccess(request, response, authentication);       
  }
  </code></pre>
  
  <p>When I try to logout, I arrive on the page "/login" (without the ?logout).
  I don't understand why it redirects me on this page.</p>
  
  <p>I think the application is trying to redirect me on "/login?logout", but since I'm no longer connected, Spring security wants me to log in again.</p>
  
  <p>When I try to access the "/login?logout" page while I am logged in, it displays the good page.</p>
  
  <p>I found a solution to this problem by adding this :</p>
  
  <pre><code>            .authorizeRequests()
              .antMatchers("/error","/login").permitAll()
  </code></pre>
  
  <p>Why didn't <code>loginPage("/login").permitAll()</code> do this?
  Did I do something wrong?</p>