79203955

Date: 2024-11-19 15:14:27
Score: 4.5
Natty:
Report link

Answering here, incase any one else facing the same issue.

  1. The HttpSession was not getting invalidated cause the JSESSIONID was not coming in the logout request due to the SameSite changes happened. So need to configure this.
  2. The Logout response was not being sent cause of the X-Frame-Options: Deny set by the spring security. https://docs.spring.io/spring-security/reference/features/exploits/headers.html#headers-frame-options so cause of this it was not setting the responses in my case.
Reasons:
  • No code block (0.5):
  • Me too answer (2.5): facing the same issue
  • Self-answer (0.5):
  • Low reputation (1):
Posted by: Sasirekha Kumaran