title: Removing user login credentials from session when user logout in spring-security
body: <p>I am new to Spring and Spring-Security. I have been going through the tutorials
  <a href="http://howtodoinjava.com/2013/04/16/login-form-based-spring-3-security-example/" rel="nofollow noreferrer">here</a></p>
  <p>The user are not allowed to hit add employee page without login. So if you hit add employee page, you will be directed to the login page and when login succeeded you are directed to the add employee page automatically.</p>
  <p>But once the user logged in add employee link can be accessed even after the user logs out. It can be accessed even after the server is restarted, I had to close the browser window for the login credentials to be destroyed.</p>
  <p>It works fine when when I keep the logout url as &quot;j_spring_security_logout&quot; which I dont want to use. I want to use custom feild names and urls, is it possible?</p>
  <p>This is how my spring-security.xml looks</p>
  <pre><code>&lt;http auto-config=&quot;true&quot; use-expressions=&quot;true&quot;&gt;
      &lt;intercept-url pattern=&quot;/login&quot; access=&quot;permitAll&quot; /&gt;
      &lt;intercept-url pattern=&quot;/logout&quot; access=&quot;permitAll&quot; /&gt;
      &lt;intercept-url pattern=&quot;/accessdenied&quot; access=&quot;permitAll&quot; /&gt;
      &lt;intercept-url pattern=&quot;/**&quot; access=&quot;hasRole('ROLE_USER')&quot; /&gt;
      &lt;form-login login-page=&quot;/login&quot; default-target-url=&quot;/list&quot;
          authentication-failure-url=&quot;/accessdenied&quot; /&gt;
      &lt;logout logout-success-url=&quot;/logout&quot; invalidate-session=&quot;true&quot;
          delete-cookies=&quot;true&quot; /&gt;
  &lt;/http&gt;
  &lt;authentication-manager alias=&quot;authenticationManager&quot;&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name=&quot;hasif&quot; password=&quot;password&quot; authorities=&quot;ROLE_USER&quot; /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  <p>This is how my LoginController looks</p>
  <pre class="lang-java prettyprint-override"><code>@Controller
  public class LoginController {
  
      @RequestMapping(value = &quot;/login&quot;, method = RequestMethod.GET)
      public String login() {     
          return &quot;login&quot;;
      }
  
      @RequestMapping(value = &quot;/logout&quot;, method = RequestMethod.GET)
      public String logout(HttpServletRequest request) {
          HttpSession session = request.getSession(false);
          session.invalidate();
          return &quot;logout&quot;;
      }
  
      @RequestMapping(value = &quot;/accessdenied&quot;, method = RequestMethod.GET)
      public String accessdenied() {
          return &quot;accessdenied&quot;;
      }
  }
  </code></pre>