Remember-me token is not invalidated on logout with expired or invalid session

Describe the bug

The remember-me token is not invalidated when navigating to the logout URL using a request which includes both of:

• a missing, invalid, or expired session cookie
• a valid remember-me token cookie

This occurs because the spring-security logout filter is applied before session-management, remember-me authentication, and any other authentication filters.

To Reproduce

1. Login to a spring-security application, with session management, remember-me authentication, and logout configured.
2. Remove the session cookie, or replace with an invalid cookie.
3. Navigate to the logout URL.
4. Attempt to auto-login using the remember-me token, login succeeds.

Step 2 is not likely to occur in practice. However, the following is possible in a real-world-scenario, but is difficult to reproduce. During the login request (step 2), the following occurs:

1. The session cookie in the browser is included in the logout request, and the request sent.
2. The session expires.
3. The server subsequently receives the request.

In this scenario, the remember-me token should definitely be invalidated. However, I expect that it would not be as the LogoutFilter is applied before the session-management and remember-me authentication filters.

Expected behavior
In the above scenarios, we expect the remember-me token to have been invalidated. Thus subsequent auto-login attempts using that token should fail.

Sample

Not provided.

Start by tracing the logout URL through the LogoutFilter, session-management, and remember-me authentication filters described in the issue. Reproduce the request with an invalid or expired session cookie and a valid remember-me token. Done means logout invalidates the remember-me token and a subsequent auto-login attempt fails.