Fix logout: call SecurityService logout endpoint to fully invalidate session

Shipped

November 26, 2025 at 8:53 PM UTC

Author

snadjafinia

Commit

b551526

- Call SecurityService /api/security/logout to properly invalidate session on Java backend - This ensures session is deleted, CSRF tokens are removed, and session is fully cleaned up - Prevents issue where logging in with different account after logout still uses old session - Keep Redis cleanup as backup in case SecurityService call fails