From 3f62a5c868052f439f57e69e9012f6344c58b562 Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Thu, 28 Dec 2006 21:23:35 +0000
Subject: [PATCH] SEC-404: NPE when logging out if user not already logged in.

---
 .../ui/rememberme/TokenBasedRememberMeServices.java             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java b/core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java
index d2685a41d0..1e004fc86c 100644
--- a/core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java
+++ b/core/src/main/java/org/acegisecurity/ui/rememberme/TokenBasedRememberMeServices.java
@@ -292,7 +292,7 @@ public class TokenBasedRememberMeServices implements RememberMeServices, Initial
     }
 
     public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
-        cancelCookie(request, response, "Logout of user " + authentication.getName());
+        cancelCookie(request, response, "Logout of user " + authentication == null ? "Unknown" : authentication.getName()); 
     }
 
     protected Cookie makeCancelCookie(HttpServletRequest request) {