This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch 3.x in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 436933e40f47f9fc76f3a598e6f9201dfb2694a3 Author: lprimak <[email protected]> AuthorDate: Wed May 20 20:48:14 2026 -0500 make sure subject's session gets fully cleared fix for #2704 --- core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java | 4 ++++ .../main/java/org/apache/shiro/subject/support/DelegatingSubject.java | 2 +- .../src/test/java/org/apache/shiro/subject/DelegatingSubjectTest.java | 2 ++ 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java index 58149cd93..d97be6894 100644 --- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java @@ -35,6 +35,7 @@ import org.apache.shiro.subject.PrincipalCollection; import org.apache.shiro.subject.Subject; import org.apache.shiro.subject.SubjectContext; import org.apache.shiro.subject.support.DefaultSubjectContext; +import org.apache.shiro.subject.support.DelegatingSubject; import org.apache.shiro.util.CollectionUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -603,6 +604,9 @@ public class DefaultSecurityManager extends SessionsSecurityManager { Session s = subject.getSession(false); if (s != null) { s.stop(); + if (subject instanceof DelegatingSubject delegatingSubject) { + delegatingSubject.sessionStopped(); + } } } diff --git a/core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java b/core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java index 903006bc5..1cc764eee 100644 --- a/core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java +++ b/core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java @@ -378,7 +378,7 @@ public class DelegatingSubject implements Subject { } } - private void sessionStopped() { + public void sessionStopped() { this.session = null; } diff --git a/core/src/test/java/org/apache/shiro/subject/DelegatingSubjectTest.java b/core/src/test/java/org/apache/shiro/subject/DelegatingSubjectTest.java index 6da337ab3..ecccb0db5 100644 --- a/core/src/test/java/org/apache/shiro/subject/DelegatingSubjectTest.java +++ b/core/src/test/java/org/apache/shiro/subject/DelegatingSubjectTest.java @@ -151,6 +151,8 @@ public class DelegatingSubjectTest { //login as user1 Subject subject = new Subject.Builder(sm).buildSubject(); subject.login(new UsernamePasswordToken("user1", "user1")); + // duplicate login, test for https://github.com/apache/shiro/issues/2704 + subject.login(new UsernamePasswordToken("user1", "user1")); assertThat(subject.isRunAs()).isFalse(); assertThat(subject.getPrincipal()).isEqualTo("user1");
