Invalidating the session won't help much with Basic auth because the browser will continue sending the Authorization header and you'll just get a new session id, which the user won't even notice. The user will not appear to be logged out.

HTTP Basic auth has actually no concept of logout because it's a stateless protocol (sends credentials for every request). It's a very old protocol, and browsers will simply continue sending the credentials automatically as long as the browser is open. I've heard that there are some hacks that can somewhat emulate a logout experience, but I don't know if or how well they work.

There might be a way to get browsers to throw the credentials away without reopening the browser, but I don't know of it, and it will probably be different for different browsers. I tried clearing my active logins in FF but it didn't do anything.

If you switched because it would be easier for your programmatic clients to access the data, there are at least a couple alternatives to switching entirely to Basic auth..

1) You can still authenticate programmatic clients using JEE form-based auth, it just requires a little more effort. You have to watch for 302 redirects to an HTML page containing the standard login form field IDs (I think it's j_user_id and j_password?). You also have to maintain the JSESSIONID cookie so that it knows who you are for subsequent requests.

2) You could implement a custom authentication solution to handle both form-based AND basic auth. It would require some work to implement this and you'd likely need to insert a proxy in front of the server. I've seen this working in practice.