// Must permit all requests to the desired url .and() .logout() .invalidateHttpSession(true) .logoutSuccessUrl("/login?logout=true") .permitAll().logoutUrl("/logout");