https://bz.apache.org/bugzilla/show_bug.cgi?id=60380
Bug ID: 60380
Summary: HttpServletRequest#logout() never calls
TomcatPrincipal#logout()
Product: Tomcat 8
Version: 8.5.x-trunk
Hardware: All
OS: All
Status: NEW
Severity: major
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: 1983-01...@gmx.net
Target Milestone: ----
If the client code calls HttpServletRequest#logout(), it is delegated to
getContext().getAuthenticator().logout(this); but
AuthenticatorBase#logout(Request) never calls TomcatPrincipal#logout() to free
resources. The only spot where this method is called is in
StandardSession#expire(boolean).
A completely request-based application cannot free the principal without ugly
hacks.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
