Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-374

Session Cookie will not be deleted on subjects logout

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Cannot Reproduce
    • 1.2.0
    • None
    • Session Management, Subject
    • None
    • GF3.1.2, JSF

    Description

      Our web application initializes Shiro through an .ini file. Within the ini file we set the application cookie as following:

      1. Cookie Management
        cookie = org.apache.shiro.web.servlet.SimpleCookie
        cookie.name = AppCookie
        cookie.secure = true
        cookie.httpOnly = false
        securityManager.sessionManager.sessionIdCookie = $cookie

      Shiro runs in "native" session mode. When an user enters the application the MyCookie and an JSESSIONID cookie will be created. The session will be authenticated on subject.login(...). Everything works fine until the user log out and we call subject.logout() method.

      It seems that the JSESSIONID cookie will not be deleted. The value of the cookie stays always the same, while the value(id) of our AppCookie always change. The problem is that the user get the same session again if he log in again. That means that the settings the user made before logout already exists on relogin.

      Attachments

        1. appcookies.png
          23 kB
          Sven Moschel

        Activity

          People

            Unassigned Unassigned
            s.moschel Sven Moschel
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: