[SHIRO-633] Remove HttpSession attributes when invalidated

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.4.0-RC2
• Component/s: Session Management
• Environment: 4.11.9-1-ARCH x86_64 GNU/Linux
• Assignee: Unassigned
• Reporter: Michael Pusterhofer
• Created: 22/Jul/17 09:57
• Updated: 23/Jul/17 17:33

Description

When calling logout the HttpSession does not remove the attributes added throughout the session. This results in the HttpSession not being valid after the logout longer valid and the RAP application to wait forever, due to the HttpSessionBindingListener not being called.

The problem can be found in the RAP forum

Apache tomcat invalidate states that it should Invalidate the session and then unbind any objects bound to it.