Search code examples
javaauthenticationspring-securitycsrfsession-management

Why differrent session ids are generated after logging out from multiple tabs?


I am using Spring security in my application. I just came across one very specific issue. When I am using multiple tabs and if I log out from all the tabs sequentially. Each page has new sessionid values (fiddler shows new session id for each login page request). This is causing issues since only the latest login page works and all others show sessionid mismatch error.

How can I solve this ?


Solution

  • When you logout, the server will kill your current session, and create a new one. This new session is of course represented by a different sessionid.

    Thus, the second time you hit the logout link, you got a login page with a new sessionid.

    If you were to then refresh the 1st tab, after logging out the 2nd tab, you would likely have the proper sessionid, and be able to log in from there.