SEC-3184: PersistentTokenBasedRememberMeServices.logout doesn't work properly with SessionCreationPolicy.STATELESS

Scott Albertine (Migrated from SEC-3184) said:

In the PersistentTokenBasedRememberMeServices.logout method, there's a clause that (as it should) deletes all persisted tokens for the current user, assuming we know who the current user is. This is great! However, in my application, I'm using SessionCreationPolicy.STATELESS, to disable in-memory sessions, for clustering purposes. Thus, on any POST to /logout, the only authentication the user has is the RememberMe token that we're trying to clear. This is a problem, because due to the ordering of filters set in FilterComparator, the LogoutFilter that triggers this handler happens BEFORE the RememberMeAuthenticationFilter, which means that there is no way for the LogoutFilter to know which user we're authenticated as, and thus we never remove the user tokens.

This can be fixed by re-ordering the filters in FilterComparator to put the LogoutFilter after the RememberMeAuthenticationFilter.

Start with FilterComparator and PersistentTokenBasedRememberMeServices.logout to trace the filter ordering during a stateless POST to /logout. Verify that the ordering lets the remember-me authentication identify the user before logout clears persisted tokens, and confirm that the reported token-removal behavior is fixed.