title: Logout leaves behind JSESSIONID on the browser. How to clear it?
body: <p>I am using the following code for logging out a user off my system.</p>
  
  <pre><code>/**
   * This function helps to set the session attribute for the present user to null and then
   * removes the attribute itself and this helps in clearing the session
   * @param request
   * @param response
   */
  @RequestMapping(value = AuthConstants.EXIT, method = RequestMethod.POST)
  public void exitPrime(HttpServletRequest request, HttpServletResponse response) {
          /*Getting session and then invalidating it*/
          HttpSession session = request.getSession(false);
          if(request.isRequestedSessionIdValid() &amp;&amp; session != null)
          {
              session.invalidate();
  
          }
  }
  </code></pre>
  
  <p>This leads to a successful logout but the JSESSION ID given by the while logging in still remains in the browser due to which for any new user the same JSESSION ID is used again while Logging In. I want the JSESSIONID cookie to be valid only for the current session and once the user logs out, it should be destroyed or invalid for the login done for the next time. My Login Code is as follows :-</p>
  
  <pre><code>/**
   * This method allows one to log into the system and generates a token for a valid employee.
   * @param authRequest
   * @param request
   * @param response
   * @return
   */
  @RequestMapping(value = AuthConstants.ENTRY, method = RequestMethod.POST, consumes = ApplicationConstants.APPLICATION_JSON)
  public @ResponseBody
  AuthResponse primeEntry(@RequestBody AuthRequest authRequest,HttpServletRequest request, HttpServletResponse response) {
      AuthResponse authResponse = new AuthResponse();
      if(authRequest != null &amp;&amp; authRequest.getEmployeeAuth().getEmployeeNumber() != null 
              &amp;&amp; !authRequest.getEmployeeAuth().getEmployeeNumber().isEmpty()){
          /*To check whether the user is valid*/
          String employeeNumber = authRequest.getEmployeeAuth().getEmployeeNumber();
          UserBean userBean = new UserBean();
          userBean = userService.getUser(employeeNumber);
          if(userBean != null)
              {
              HttpSession session = request.getSession(true);
              session.setAttribute("user", userBean);
              setAuthResponseSuccess(authResponse);
          }else{
              /*If user does not exist the too throw error 500*/
              setAuthResponseFailure(authResponse);
          }
      }else{
          /*If input JSON is not valid then throw error 500*/
          setAuthResponseFailure(authResponse);
      }
      return authResponse;
  }
  </code></pre>
  
  <p>I am using Spring 3.2 and want to do Login and Logout Manually. Please Help.</p>
  
  <p>Full Class Code</p>
  
  <pre><code>@Controller
  @RequestMapping(value = "/auth")
  public class AuthController {
      @Autowired
      HttpServletRequest request;
  
      @Autowired
      HttpSession session;
  
      @Autowired
      IUserService userService;
  
      /**
       * This method allows one to log into the system and generates a token for a valid employee.
       * @param authRequest
       * @param request
       * @param response
       * @return
       */
      @RequestMapping(value = AuthConstants.ENTRY, method = RequestMethod.POST, consumes = ApplicationConstants.APPLICATION_JSON)
      public @ResponseBody
      AuthResponse primeEntry(@RequestBody AuthRequest authRequest,HttpServletRequest request, HttpServletResponse response) {
          AuthResponse authResponse = new AuthResponse();
          if(authRequest != null &amp;&amp; authRequest.getEmployeeAuth().getEmployeeNumber() != null 
                  &amp;&amp; !authRequest.getEmployeeAuth().getEmployeeNumber().isEmpty()){
              /*To check whether the user is valid*/
              String employeeNumber = authRequest.getEmployeeAuth().getEmployeeNumber();
              UserBean userBean = new UserBean();
              userBean = userService.getUser(employeeNumber);
              if(userBean != null)
                  {
                  HttpSession session = request.getSession(true);
                  session.setAttribute("user", userBean);
                  setAuthResponseSuccess(authResponse);
              }else{
                  /*If user does not exist the too throw error 500*/
                  setAuthResponseFailure(authResponse);
              }
          }else{
              /*If input JSON is not valid then throw error 500*/
              setAuthResponseFailure(authResponse);
          }
          return authResponse;
      }
  
  
      /**
       * This function helps to set the session attribute for the present user to null and then
       * removes the attribute itself and this helps in clearing the session
       * @param request
       * @param response
       */
      @RequestMapping(value = AuthConstants.EXIT, method = RequestMethod.POST)
      public void exitPrime(HttpServletRequest request, HttpServletResponse response) {
              /*Getting session and then invalidating it*/
              HttpSession session = request.getSession(false);
              if(request.isRequestedSessionIdValid() &amp;&amp; session != null)
              {
                  session.invalidate();
  
              }
      }
  
      private AuthResponse setAuthResponseFailure(AuthResponse authResponse) {
          authResponse.setResponseCode(ApplicationConstants.INTERNAL_ERROR_CODE);
          authResponse.setStatus(StatusType.FAILURE);
          authResponse.setResponseMsg(ApplicationConstants.INTERNAL_ERROR_MESSAGE);
          return authResponse;
      }
      private AuthResponse setAuthResponseSuccess(AuthResponse authResponse){
          authResponse.setResponseCode(ApplicationConstants.OK);
          authResponse.setStatus(StatusType.SUCCESS);
          authResponse.setResponseMsg(ApplicationConstants.LOGIN_SUCCESS);
          return authResponse;
      }
  }
  </code></pre>