title: CSRF Token lifecycle after Logout
body: <p>While playing with <code>Spring security</code>, I was wondering about the approach of <code>CSRF</code> (Cross Site Request Forgery) Token lifecycle at application logout.</p>
  
  <p>Let's say a user logs in and navigates on my website. Then he logs out. Should I invalidate the CSRF token (implemented as a cookie in my case, if it matters)?</p>
  
  <p>If no, is there any caveat I should be aware of in term of security?</p>
  
  <p>If yes, how am I supposed to manage any further action of the user on the application? Without any <code>CSRF</code> Token, the server-side will forbid some actions. Should I generate a new Token then?</p>
  
  <p>I'm using <code>Spring boot</code> for the server side, and it seems it invalidates by default the Token (or I made something wrong that leads to this result...)</p>
  
  <p>Thanks for any help.</p>