The bug is located in method org.apache.jackrabbit.spi2dav.RepositoryServiceImpl.obtain(CredentialsWrapper credentials, String workspaceName)
When passing null to workspaceName parameter that's what happens:
- an instance of org.apache.jackrabbit.spi2dav.SessionInfoImpl created with null workspace name (line 770)
- HttpClient created for this sessionInfo and stored to cache with sessionInfo as a key (line 779)
- a new sessionInfo created with effective workspace name (line 793)
- sessionInfo with effective workspace name returned to caller
The problem is that HttpClient created on step 2 will not be removed from cache on call to org.apache.jackrabbit.spi2dav.RepositoryServiceImpl.dispose(SessionInfo) because it is linked to sessionInfo created on step 1 which is thrown away on step 3.
The proposed solution is pretty easy - just call removeClient(SessionInfo) before creating new sessionInfo on step 3.
See attached patch.