Do not use the HttpSession invalidate method for programmatic security logout in Servlet 3.0

Do not use the HttpSession invalidate method for programmatic security logout. Instead use the HttpServletRequest logout method which was introduced in Java EE 6 as part of the Servlet 3.0 specification.

For more information, see HttpServletRequest.