Yes, we're now running our Black Friday Sale. All Access and Pro are 33% off until 2nd December, 2025:
Spring Security Logout
Last updated: October 11, 2022
Modern software architecture is often broken. Slow delivery leads to missed opportunities, innovation is stalled due to architectural complexities, and engineering resources are exceedingly expensive.
Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.
With Orkes Conductor managed through Orkes Cloud, developers can focus on building mission critical applications without worrying about infrastructure maintenance to meet goals and, simply put, taking new products live faster and reducing total cost of ownership.
Try a 14-Day Free Trial of Orkes Conductor today.
Modern software architecture is often broken. Slow delivery leads to missed opportunities, innovation is stalled due to architectural complexities, and engineering resources are exceedingly expensive.
Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.
With Orkes Conductor managed through Orkes Cloud, developers can focus on building mission critical applications without worrying about infrastructure maintenance to meet goals and, simply put, taking new products live faster and reducing total cost of ownership.
Try a 14-Day Free Trial of Orkes Conductor today.
Mocking is an essential part of unit testing, and the Mockito library makes it easy to write clean and intuitive unit tests for your Java code.
Get started with mocking and improve your application tests using our Mockito guide:
Spring 5 added support for reactive programming with the Spring WebFlux module, which has been improved upon ever since. Get started with the Reactor project basics and reactive programming in Spring Boot:
Since its introduction in Java 8, the Stream API has become a staple of Java development. The basic operations like iterating, filtering, mapping sequences of elements are deceptively simple to use.
But these can also be overused and fall into some common pitfalls.
To get a better understanding on how Streams work and how to combine them with other language features, check out our guide to Java Streams:
Explore Spring Boot 3 and Spring 6 in-depth through building a full REST API with the framework:
Yes, Spring Security can be complex, from the more advanced functionality within the Core to the deep OAuth support in the framework.
I built the security material as two full courses - Core and OAuth, to get practical with these more complex scenarios. We explore when and how to use each feature and code through it on the backing project.
You can explore the course here:
Modern software architecture is often broken. Slow delivery leads to missed opportunities, innovation is stalled due to architectural complexities, and engineering resources are exceedingly expensive.
Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.
With Orkes Conductor managed through Orkes Cloud, developers can focus on building mission critical applications without worrying about infrastructure maintenance to meet goals and, simply put, taking new products live faster and reducing total cost of ownership.
Try a 14-Day Free Trial of Orkes Conductor today.
Spring Data JPA is a great way to handle the complexity of JPA with the powerful simplicity of Spring Boot.
Get started with Spring Data JPA through the guided reference course:
Refactor Java code safely — and automatically — with OpenRewrite.
Refactoring big codebases by hand is slow, risky, and easy to put off. That’s where OpenRewrite comes in. The open-source framework for large-scale, automated code transformations helps teams modernize safely and consistently.
Each month, the creators and maintainers of OpenRewrite at Moderne run live, hands-on training sessions — one for newcomers and one for experienced users. You’ll see how recipes work, how to apply them across projects, and how to modernize code with confidence.
Join the next session, bring your questions, and learn how to automate the kind of work that usually eats your sprint time.
Yes, we're now running our Black Friday Sale. All Access and Pro are 33% off until 2nd December, 2025:
1. Overview
This article is building on top of our Form Login tutorial and is going to focus on the how to configure Logout with Spring Security.
Further reading:
Spring Security: Authentication with a Database-backed UserDetailsService
A quick guide to to create a custom database-backed UserDetailsService for authentication with Spring Security.
Introduction to Spring Method Security
A guide to method-level security using the Spring Security framework.
Spring Security - Redirect to the Previous URL After Login
A short example of redirection after login in Spring Security
2. Basic Configuration
The basic configuration of Spring Logout functionality using the logout() method is simple enough:
@Configuration
@EnableWebSecurity
public class SecSecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
//...
.logout()
//...
}
//...
}And using XML configuration:
<http>
...
<logout/>
</http>The element enables the default logout mechanism – which is configured to use the following logout url: /logout which used to be /j_spring_security_logout before Spring Security 4.
3. The JSP and the Logout Link
Continuing this simple example, the way to provide a logout link in the web application is:
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head></head>
<body>
<a href="<c:url value="/logout" />">Logout</a>
</body>
</html>4. Advanced Customizations
4.1. logoutSuccessUrl()
After the logout process is performed successfully, Spring Security will redirect the user to a specified page. By default, this is the root page (“/”) but this is configurable:
//...
.logout()
.logoutSuccessUrl("/afterlogout.html")
//...This can also be done using XML configuration:
<logout logout-success-url="/afterlogout.html" />Depending on the application, a good practice is to redirect the user back to the login page:
//...
.logout()
.logoutSuccessUrl("/login.html")
//...4.2. logoutUrl()
Similar to other defaults in Spring Security, the URL that actually triggers the logout mechanism has a default as well – /logout.
It is, however, a good idea to change this default value, to make sure that no information is published about what framework is used to secure the application:
.logout()
.logoutUrl("/perform_logout")And through XML:
<logout
logout-success-url="/anonymous.html"
logout-url="/perform_logout" />4.3. invalidateHttpSession and deleteCookies
These two advanced attributes control the session invalidation as well as a list of cookies to be deleted when the user logs out. As such, invalidateHttpSession allows the session to be set up so that it’s not invalidated when logout occurs (it’s true by default).
The deleteCookies method is simple as well:
.logout()
.logoutUrl("/perform_logout")
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID")And the XML version:
<logout
logout-success-url="/anonymous.html"
logout-url="/perform_logout"
delete-cookies="JSESSIONID" />4.4. logoutSuccessHandler()
For more advanced scenarios, where the namespace is not flexible enough, the LogoutSuccessHandler bean from the Spring Context can be replaced by a custom reference:
@Bean
public LogoutSuccessHandler logoutSuccessHandler() {
return new CustomLogoutSuccessHandler();
}
//...
.logout()
.logoutSuccessHandler(logoutSuccessHandler());
//...The equivalent XML configuration is:
<logout
logout-url="/perform_logout"
delete-cookies="JSESSIONID"
success-handler-ref="customLogoutSuccessHandler" />
...
<beans:bean name="customUrlLogoutSuccessHandler" />Any custom application logic that needs to run when the user successfully logs out can be implemented with custom logout success handler. For example – a simple audit mechanism keeping track of the last page the user was on when they triggered logout:
public class CustomLogoutSuccessHandler extends
SimpleUrlLogoutSuccessHandler implements LogoutSuccessHandler {
@Autowired
private AuditService auditService;
@Override
public void onLogoutSuccess(
HttpServletRequest request,
HttpServletResponse response,
Authentication authentication)
throws IOException, ServletException {
String refererUrl = request.getHeader("Referer");
auditService.track("Logout from: " + refererUrl);
super.onLogoutSuccess(request, response, authentication);
}
}Also, keep in mind that this custom bean has the responsibility to determine the destination to which the user is directed after logging out. Because of this, pairing the logoutSuccessHandler attribute with logoutSuccessUrl is not going to work, as both cover similar functionality.
5. Conclusion
In this example, we started by setting up a simple logout sample with Spring Security, and we then discussed the more advanced options available.
The code backing this article is available on GitHub. Once you're logged in as a Baeldung Pro Member, start learning and coding on the project.
When the project runs locally, the sample HTML can be accessed at:
