title: Spring Security: session.invalidate() vs invalidate-session="true"
body: <p>What's the difference between the two? I'm not so sure but I believe the HttpServletReqest.getSession.invalidate() invalidates the user's session only while the  invalidate-session="true" invalidates the session and redirects the user to the defined session-expired page. Please correct me if I'm wrong, I would want to understand this more. Thanks.</p>