@Groovy Duke thank you for the links. I've casually added Java Melody yesterday to Dueuno, not the plugin just the dependency. For reasons I'm still not aware of, invalidating all sessions does not log out the users. Spring Security is doing something else I guess. I need to investigate further.