Details
Major Description
We support creating ReplayCache instances to detect replay attacks for signed Timestamps, SAML (one-time-use) + UsernameToken nonces. The ReplayCache instances should be created externally and set on the RequestData Object for verification.
However, if the caches are enabled (by boolean methods on RequestData), and no caches are actually specified, we end up creating new instances internally. However, as these are not stored for the next request, we end up with a load of open cache instances (on each request).
The fix is not to create the ReplayCache instances internally. It's up to the calling code to manage them.