I'm not sure what you mean by "session info 'leaking'". The #unbind(Subject) call just above the finally block is the mechanism that disassociates state that would allow further requests to be associated with the Subject. Once that method is called, Shiro would consider the session 'anonymous'.
Other state may still exist in the session beyond the keys used for Subject association. The ones that I can find via an IntelliJ 'find usages' search: - The HttpServletSession implementation uses two String constants as attribute keys in its implementation - The DelegatingSubject's 'runAs' implementation uses a session attribute to remember the runAs stack. - The 'redirect to login and the redirect to the current page' feature uses a 'saved request' session attribute. Other than those 3, I can't see any other usages of session attribute data. The logout method however only clears the session attributes that are used for Subject association - not any of those other possible 3 (or any other that may be used by Shiro in the future). Regards, Les On Wed, Nov 24, 2010 at 7:19 PM, Alan D. Cabrera <[email protected]> wrote: > I won't have any Shiro session info "leaking" if I do this will I? > > > Regards, > Alan > > On Nov 24, 2010, at 6:39 PM, Les Hazlewood wrote: > >> Hi Alan, >> >> You'll need to override the >> org.apache.shiro.mgt.DefaultSecurityManager#logout(Subject) >> implementation to not execute the last 'finally' block. >> >> HTH, >> >> Les >> >> On Wed, Nov 24, 2010 at 6:19 PM, Alan D. Cabrera <[email protected]> >> wrote: >>> Logging out invalidates my HttpSession. I would prefer that it only >>> removes shiro stuff. What do I need to override to get this behavior? >>> >>> >>> Regards, >>> Alan
