java - Why SpringSecurity, after a logout, keeps giving the same authenticated Principal -

so using spring security spring boot. wanted make own authenticationprovider, using db in own way, did authenticate method:

@override     public authentication authenticate(authentication authentication) throws authenticationexception {         string email = authentication.getname();         string password = authentication.getcredentials().tostring();           userwithemail userwithemail = authservice.getuserbyemail(email);         if (userwithemail == null)             return null;         if (userwithemail.getpassword().equals(password)) {                usernamepasswordauthenticationtoken authenticated_user = new usernamepasswordauthenticationtoken(userwithemail, password, arrays.aslist(registered_user_simple_granted_authority));             return authenticated_user;         } else {             return null;         }     } 

this, if use default /login page form, works , after if add following modelattribute controller, gets correctly filled userwithemail object:

@modelattribute("userwithemail")     public userwithemail userwithemail(){         authentication authentication = securitycontextholder.getcontext().getauthentication();          object principal = authentication.getprincipal();         if (principal instanceof userwithemail)             return (userwithemail) principal;         else             return null;      } 

the problem if hit /login?logout, correctly displays logged out, if go through controller again still same userwithemail object principal , has property authenticated=true

this java config spring security:

http                 .formlogin()                 .defaultsuccessurl( "/" )                 .usernameparameter( "username" )                 .passwordparameter( "password" )                 .and()                  .logout().invalidatehttpsession(true).deletecookies("jsessionid").permitall().and()                  .authorizerequests()                 .antmatchers("*/**").permitall()                 .antmatchers("/static/**").permitall()                 .antmatchers("/profile").hasrole(myauthenticationprovider.registered_user_auth)                  .and().authenticationprovider(getauthprovider()); 

i'm new spring security maybe i'm missing something... can help?

according docs here csrf post mandatory logging out, csrf token attack protection.

because using custom templating engine had intercept csrf token in model attribute request, this:

@modelattribute("crsf_token") public csrftoken getcrsftoken(httpservletrequest request, model model) {     csrftoken token = (csrftoken) request.getattribute("_csrf");      return token; } 

because not getting copied in model templating engine.