beginnerSpring Security Architecture: The Filter Chain & Internal Flow

What exactly does logout() clean up, and why are all three parts necessary?

invalidateHttpSession(true) destroys the server-side session object itself; deleteCookies("JSESSIONID") instructs the browser to discard the now-meaningless session cookie; and Spring Security also clears the in-memory SecurityContextHolder for the current thread. Skipping any one of these can leave a stale artifact behind — e.g., forgetting to delete the cookie leaves an invalid cookie sitting in the browser, which is mostly harmless but sloppy and can confuse debugging.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Why use @Profile with separate @Configuration classes instead of one config class with if-statements checking the active environment? →← Back to all Spring Security questions