spring-projects / spring-projects/spring-security
spring-cas cannot logout other cas client caused by SessionFixationProtectionStrategy
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
I am doing spring cas intergration part, today I got a issue, I have multiple cas clients, when I logout client A, but client B cannot logout successful by cas SingleSignOutFilter. When I am looking into the code logic, I found SingleSignOutFilter is base on cached session id to logout user. But SessionFixationProtectionStrategy will replace the session id which already cached in SingleSignOutFilter.
Actual Behavior
SessionFixationProtectionStrategy didn't replace the cached session id in SingleSignOutFilter.
Expected Behavior
SessionFixationProtectionStrategy should replace the cached session id in SingleSignOutFilter also.
Configuration
Version
5.1.4.RELEASE
Sample
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how SingleSignOutFilter caches session IDs and how SessionFixationProtectionStrategy replaces them during CAS logout. Reproduce the multiple-client logout scenario described in the issue, then verify that the cached ID is updated so logging out client A also permits client B to log out successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100