title: Spring Security Logout Redirects to Logout Success and then Immediately to Invalid Session Page
body: <p>As per the post <a href="https://stackoverflow.com/questions/2601013/spring-security-redirect-to-invalid-session-url-instead-of-logout-success-url-o">Spring Security: Redirect to invalid-session-url instead of logout-success-url on successful logout</a>, when logging out of a session Spring Security redirects to the user defined invalid-session-url. </p>
  
  <pre><code>&lt;session-management invalid-session-url="/invalidSession.jsp"&gt;
      &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
  &lt;/session-management&gt; 
  </code></pre>
  
  <p><strong>However</strong>, if a logout-success url is set </p>
  
  <pre><code>&lt;logout invalidate-session="true" 
              logout-success-url="/logoutSuccess.jsp" 
              logout-url="/logout" /&gt;
  </code></pre>
  
  <p>Spring still redirects to the invalid session URL after redirecting to the logout-success url. This happens even when the logoutSuccess url is unsecured.  I.e.,</p>
  
  <pre><code>&lt;intercept-url pattern="/logoutSuccess.jsp*" access="permitAll"/&gt; 
  </code></pre>
  
  <p><strong>Is this a Spring bug?  Since the logout-success-url is set and unsecured it seems that the user should not be redirected to invalid session url after reaching the logout success url.</strong></p>
  
  <p>The log looks as follows:</p>
  
  <pre><code>INFO: [DEBUG,SimpleUrlLogoutSuccessHandler] Using default Url: /logoutSuccess.jsp
  INFO: [DEBUG,DefaultRedirectStrategy] Redirecting to '/Application/logoutSuccess.jsp'
  INFO: [DEBUG,HttpSessionSecurityContextRepository] SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
  INFO: [DEBUG,SecurityContextPersistenceFilter] SecurityContextHolder now cleared, as request processing completed
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 1 of 10 in additional filter chain; firing Filter: 'ConcurrentSessionFilter'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  INFO: [DEBUG,HttpSessionSecurityContextRepository] No HttpSession currently exists
  INFO: [DEBUG,HttpSessionSecurityContextRepository] No SecurityContext was available from the HttpSession: null. A new one will be created.
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 3 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 4 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
  INFO: [DEBUG,AnonymousAuthenticationFilter] Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
  INFO: [DEBUG,FilterChainProxy] /logoutSuccess.jsp at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'
  INFO: [DEBUG,SessionManagementFilter] Requested session ID a396530a530b344ff531ab657e32 is invalid.
  INFO: [DEBUG,SimpleRedirectInvalidSessionStrategy] Starting new session (if required) and redirecting to '/invalidsession.jsp'
  INFO: [DEBUG,HttpSessionEventPublisher] Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade@564c4200]
  INFO: [DEBUG,DefaultRedirectStrategy] Redirecting to '/Application/invalidsession.jsp'
  </code></pre>