I have a problem doing "Logout" in my application, every time the user logout, redirect him to ask for his credentials again, but if the user refreshes the window (< kbd> F5 ) re-login, what I'm looking for is the way to kill the session every time the user gives "Logout" . This is the configuration I am using:
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/forgotpassword").permitAll()
.antMatchers("/validateusername").permitAll()
.antMatchers("/helpdesk").permitAll()
.antMatchers("/employee/fromusername").permitAll()
.antMatchers("/api/**").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.usernameParameter("username").passwordParameter("password")
.permitAll()
.and()
.logout()
.logoutSuccessUrl("/login?logout")
.permitAll()
.and().csrf().disable();
}