title: Spring security returns 302 when trying to logout
body: <p>I use Spring security (4.0.2.RELEASE) to secure my app.</p>
  
  <p>I can login just fine and my authenticated URLs are protected, but when I try to logout I constantly get 302 POST responses followed by a redirect to my configured failureUrl ("/cms/login?error").</p>
  
  <p>Here's my WebSecurityConfig class</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter
  {
     @Override
     protected void configure(HttpSecurity http) throws Exception
     {        
         http        
         .authorizeRequests()
             .antMatchers("/*").permitAll()
             .antMatchers("/cms/*").authenticated()
             .antMatchers("/cms/*/*").authenticated()
             .antMatchers("/cms/*/*/*").authenticated().and()
         .formLogin()
             .loginPage("/cms/login")
             .defaultSuccessUrl("/cms/login?success")
             .failureUrl("/cms/login?error")
             .permitAll().and()
         .logout()
             .logoutUrl("/cms/login?logout")
             .logoutSuccessUrl("/cms/login")
             .permitAll();
     }
  
     @Autowired
     public void configureGlobal(AuthenticationManagerBuilder auth)      throws Exception
     {
         auth.inMemoryAuthentication()
             .withUser("u")
             .password("p")
             .roles("USER");
     }
  
     @Bean
     public PasswordEncoder passwordEncoder()
     {
         return new BCryptPasswordEncoder();
     }
    }
  </code></pre>
  
  <p>Here's my login controller:</p>
  
  <pre><code>@Slf4j
  @Controller
  @RequestMapping(value = {"/cms", "/cms/login"})
  public class CmsLoginController extends CmsBaseController
  {   
      @RequestMapping
      public ModelAndView handleLogin(HttpServletResponse request,
                                      Model model,
                                      @RequestParam(value = LOGIN_SUCCESS, required = false) String success,
                                      @RequestParam(value = LOGIN_ERROR, required = false) String error,
                                      @RequestParam(value = LOGOUT, required = false) String logout)
      {   
          try
          {       
              if (success != null)
              {               
                  setLoggedIn(true);
                  request.sendRedirect(XXXXX);
              }
  
              if (error != null)
              {
                  model.addAttribute(LOGIN_ERROR, "Invalid username and password!");
              }
  
              if (logout != null)
              {
                  model.addAttribute(LOGOUT, "You've been logged out successfully.");
                  setLoggedIn(false);
              }
  
              return new ModelAndView(CMS_CONTEXT + LOGIN_URL);
          }
          catch(Exception e)
          {
              setLoggedIn(false);
              log.error(e.toString(), e);
  
              return new ModelAndView(ERROR_VIEW_NAME);
          }   
      }
  }    
  </code></pre>
  
  <p>For the record, I initially got the logout functionality working fine, but I must have introduced some change that has broken it unfortunately...</p>
  
  <p>Any thoughts?
  Thank you</p>