Front-end logout does not clear Redis-backed sessions within the undefined-session TTL

Problem Statement

With Tomcat Redis sessions enabled, a front-end user who logs out shortly after login stays logged in. A later refresh still shows an authenticated header.

This is not site-specific. It happens on the standard front-end login/logout path when Redis session management is on (common on Evergreen/cloud).

SessionMonitor is documented as flagging both back-end and front-end sessions with DOT_CLUSTER_SESSION for Redis. Front-end LoginFactory.doLogin() never sets USER_ID, so that flag is never applied. The session is stored in Redis as undefined with a short TTL (default 15 seconds).

On logout, session.invalidate() does not delete the Redis key. The following request reloads CMS_USER / USER from Redis and the user is still authenticated.

Condition	Result
Redis sessions off	Logout works
Redis sessions on, logout after undefined TTL (~15s idle)	Logout works (Redis key already expired)
Redis sessions on, logout before that TTL	Logout fails; session comes back from Redis

Steps to Reproduce

Prerequisites

TOMCAT_REDIS_SESSION_ENABLED=true
TOMCAT_REDIS_UNDEFINED_SESSION_TYPE_TIMEOUT=15 (default)
TOMCAT_REDIS_ENABLED_FOR_ANON_TRAFFIC unset or false
Front-end user login via LoginFactory (Velocity / site login, not /dotAdmin)
Control

Log in on the front end.
Wait longer than the undefined-session TTL (e.g. 20s) with no further requests.
Log out (LoginFactory.doLogout() or session.invalidate()).
Reload the page.
Expected and actual: user is logged out.

Failure

Log in on the front end.
Within ~10 seconds, log out.
Follow the logout redirect or reload the same site.
Expected: User is logged out. Header / $cmsuser / UserWebAPI.getLoggedInUser() is anonymous. Refresh stays logged out.

Actual: User still appears logged in. Waiting longer than the TTL and refreshing still shows logged in (session was already restored into Tomcat).

Optional

In Redis, the session key is still present after invalidate() and still contains USER / CMS_USER.
Repeat with TOMCAT_REDIS_SESSION_ENABLED=false: logout succeeds immediately.

Acceptance Criteria

• With Redis sessions enabled, front-end logout immediately after login ends the session. The next request or refresh does not treat the user as logged in.
• Logout after the undefined-session TTL still ends the session (no regression).
• session.invalidate() / LoginFactory.doLogout() deletes the Redis session key so a later request cannot reload CMS_USER.
• A successful logout stays logged-out after waiting longer than TOMCAT_REDIS_UNDEFINED_SESSION_TYPE_TIMEOUT (no resurrection from Redis into Tomcat).
• Front-end sessions created by LoginFactory are treated as authenticated for Redis (e.g. DOT_CLUSTER_SESSION set from CMS_USER / USER), not left undefined.

dotCMS Version

26.08.19-04 Evergreen

Severity

Medium - Some functionality impacted

Links

https://helpdesk.dotcms.com/a/tickets/39314

Start by tracing LoginFactory.doLogin() and LoginFactory.doLogout(), then inspect SessionMonitor and the session.invalidate() path used with Tomcat Redis sessions. Reproduce with TOMCAT_REDIS_SESSION_ENABLED and the undefined-session timeout configured, checking the Redis session key before and after logout. Done means front-end logout removes the Redis-backed session and remains logged out after a later refresh and timeout period.