Spring Security cannot request URL with jessionid

I am developing a web application using Spring 5.3.20, Spring Security 5.7.1 and Tomcat 9.0.62.

Here is my Spring Security settings:

<form-login login-page="/home" />
<logout logout-url="/logout"
        logout-success-url="/login?logout"
        delete-cookies="JSESSIONID"/>

<session-management invalid-session-url="/main?timeout" session-authentication-error-url="/main?error"
                    session-fixation-protection="newSession">
    <concurrency-control max-sessions="1" expired-url="/mail"
                         error-if-maximum-exceeded="true" session-registry-alias="sessionRegistry" />
</session-management>

The problem is when user logged out, the JSESSIONID cookies is deleted and the URL Rewriting kicked in.

As as result, the CSS, JS URLs become something like this.

http://localhost:8080/bookstore/resources/css/bootstrap.min-7184d3edc008c1890deb0a71e4348267.css;jsessionid=5052769FD8FEB8D2901C8CCB2B6A0C66 http://localhost:8080/bookstore/resources/js/jquery-1.12.3.min-2b6294333db8eeb65bc7717144357d23.js;jsessionid=5052769FD8FEB8D2901C8CCB2B6A0C66

The JESSIONID and semicolon are appended to the URLs which is a problem because according to those links below, the Spring Security will reject URLs that contain semicolons.

Spring getting The request was rejected because the URL contained a potentially malicious String ";"

https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/web/firewall/StrictHttpFirewall.html

There are two ways to solve this problem.

1. Not deleting the JSESSIONID cookies when logged out by removing delete-cookies="JSESSIONID"

<logout logout-url="/logout"
        logout-success-url="/login?logout"/>

2. Forcing Spring Security to allow semicolons in URL by using setAllowSemicolon(true)

But from best security practices perspectives I think both of those solution above are not really good.

Can you guys elaborate in real world web application how people handle such a situation?