Fix persistent remember-me token cleanup on logout

Contribution Overview

The Engineering Context

This contribution was made to the spring-projects/spring-securityopen-source repository. The work involved understanding the existing codebase, identifying the underlying engineering problem, implementing a focused solution, and validating the change against the project's existing behaviour and testing standards.

Original Issue

Persistent remember-me tokens were not being cleaned up correctly during logout.

When logout occurred without an Authentication, the remember-me cookie was cleared but the corresponding persistent server-side token could remain.

Engineering Problem

Understanding the Problem

PersistentTokenBasedRememberMeServices removed persistent tokens when an Authentication was available during logout, but a logout without an Authentication could leave the associated persistent remember-me token behind.

Solution

Implementation Approach

Updated the logout flow to resolve the remember-me cookie when Authentication is unavailable, look up the associated persistent token, and remove the user's tokens. Added regression coverage for logout with a valid remember-me cookie and for invalidating remember-me authentication after session logout.

Technologies

Engineering Stack