Spring boot security: delete all session data of a user when the user logout

Current scenario: Session data of previous user is available when another user logs in. Then the new user can copy documentId from session of the previous user and call REST API for delete by passing the documentId she coppied from previous user session. This allowed the new user to access and delete data which doesn't belong to him. Can I use Spring session to prevent this? I know that there are things like sessionInvalidate but Im not sure if this helps. I want all session data of a user to be deleted when she logout. I want to fix the problem by using spring session management if possible than adding some validation logic to my controller which requires me write new code and test.