Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-3221

flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Critical
    • Resolution: Done
    • Affects Version/s: 8.0.0.Final
    • Fix Version/s: 9.0.0.Beta1
    • Component/s: Security
    • Labels:
      None

      Description

      The attribute flushOnSessionInvalidation does not flush the user credentials when the session is invalidated or when it times out. If the password or roles change for the user, the only way to get the new changes is by restarting the server.

      I tried removing "cache-type=default" from the standalone-full.xml and it works, but for every action made on the site, the login method in the authentication module is called.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  swd847 Stuart Douglas
                  Reporter:
                  jimarmol Jorge Marmolejo
                • Votes:
                  15 Vote for this issue
                  Watchers:
                  22 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: