Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Not A Bug
-
None
-
None
-
None
-
None
Description
I try to implement sessionDao with redis
but I found ShiroHttpServletRequest cached HttpSession
when i login the system, for preventing session fixation attack, i call getSession().stop(), now the redis have no session information, then i call httpRequest.getSession(false), it will get the cached HttpSession that is not stored in redis. So the Exception will happened
what should I do to avoid this ?