Question: i want to generate loop of javascript in php which give me syntax error.here is what i want

```
var d1 = [
          [(new Date("01/06/2013")). getTime(),4],
          [(new Date("01/07/2013")). getTime(),0],
         ];

```

i want to make it dynamic from db.here is what i tried

```
var d1 = [
<?php
    while($rw = $oAppl->row($res))
    {
        $php_var = $rw['list_date_rent'];
        $php_var2 = $rw['rntval'];
?>            
    var php_var = "<?php echo $php_var; ?>";
    var php_var2 = "<?php echo $php_var2; ?>";
    [(new Date("+'"php_var"'+")). getTime(),php_var2],
<?php
    }
?>
];

```

Answer: 
The default CookieClearingLogoutHandler provided by spring could not clear JSESSIONID due to a difference in cookie path.

You should not change the path of cookie. This would change the cookie identity. If the cookie were set for a path like /foo and you change this to /, then the client won't associate the changed cookie with the original cookie anymore. A cookie is identified by the name and the path.

Therefore you need to implement a custom CookieClearingLogoutHandler as shown in the above solution i.e (ProperCookieClearingLogoutHandler.class) and set it to spring security as shown in below code .Instead of using .deleteCookies("JSESSIONID","USER") which adds CookieClearingLogoutHandler by default.

Spring Security Java config:

```
@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = "com.dentist.webapp")
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SessionRegistry sessionRegistry;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/resources/**", "/signup/*", "/about", "/login/*").permitAll().anyRequest()
                .authenticated()
                .and().formLogin()
                                 .loginPage("/login/form")
                                 .permitAll()
                .and().logout()
                              .invalidateHttpSession(true)
                              .clearAuthentication(true)
                             // .deleteCookies("JSESSIONID","USER")
                              .addLogoutHandler(new ProperCookieClearingLogoutHandler("JSESSIONID","USER"))
                              .permitAll()
                .and().sessionManagement()
                              .maximumSessions(1)
                              .maxSessionsPreventsLogin(true)
                              .expiredUrl("/accessDenied")
                              .sessionRegistry(sessionRegistry);

        }

    }

```
How to delete on log-out is straightforward:
you implement logout and put that code in the method:

```
    HttpSession session = request.getSession(false); 
    if (session != null) { 
       session.invalidate();
    }

```

Invalidated session will make the cookie invalid.

But I tried and found, that when I close the browser without logout, the JSESSIONID cookie survives and user able enter the system , when opens the browser.

To eliminate this I created a filter, that invalidates the session on login too, creating a new session, where your login will be performed from start.

```
@WebFilter(urlPatterns = {"/login/*"}, description = "sessionKiller", filterName="sessionKiller")
public class SessionKillerFilter implements Filter{

    @Override
    public void init(FilterConfig arg0) throws ServletException {}

    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
        //kill older session and create new one on explicit login
        //this is to prevent user to login 2-ce
        //also this is prevention of re-connect on cookie base, when browser closed and then open
        HttpServletRequest  request = (HttpServletRequest)req;
        HttpSession session =   request.getSession(false);
        if(session!=null){
            session.invalidate();//old session invalidated
        }
        request.getSession(true);//new session created

        chain.doFilter(req, resp);
    }

    @Override
    public void destroy() {}
}

```