Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-637

Refresh cached session in HTTP request after user logs out

    XMLWordPrintableJSON

    Details

    • Flags:
      Patch

      Description

      For native session management in web environments, the ShiroHttpServletRequest caches calls to getSession() by saving a copy of the current subject's session to a member variable. This copy is never updated even when the subject logs out and the session is destroyed.

      When the session is accessed again after logout, an UnknownSessionException can be thrown because the session referenced in the request is not physically available anymore (this could be the cause for SHIRO-614).

      The Shiro HTTP request therefore has to check the state of the cached session and refresh it if necessary, just as the original Jetty Request class does as well.

      Please see the attached patch for a possible solution that Works For Me™

        Attachments

        1. ShiroHttpServletRequest.patch
          0.9 kB
          Peter Karich

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                pk Peter Karich
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: