From 617e517e5e6854363d3f782424af01c03159e804 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Wed, 4 Nov 2009 17:20:13 +0000 Subject: [PATCH] SEC-1280: NullPointerException in PersistentTokenBasedRememberMeServices when logging out twice. Added check for null authentication in logout method. --- .../rememberme/PersistentTokenBasedRememberMeServices.java | 5 ++++- .../PersistentTokenBasedRememberMeServicesTests.java | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java b/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java index e88b1dc8b3..055bbb784e 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java +++ b/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java @@ -142,7 +142,10 @@ public class PersistentTokenBasedRememberMeServices extends AbstractRememberMeSe @Override public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { super.logout(request, response, authentication); - tokenRepository.removeUserTokens(authentication.getName()); + + if (authentication != null) { + tokenRepository.removeUserTokens(authentication.getName()); + } } protected String generateSeriesData() { diff --git a/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java b/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java index 2126d5a550..7b4375876b 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java @@ -121,6 +121,9 @@ public class PersistentTokenBasedRememberMeServicesTests { Cookie returnedCookie = response.getCookie("mycookiename"); assertNotNull(returnedCookie); assertEquals(0, returnedCookie.getMaxAge()); + + // SEC-1280 + services.logout(request, response, null); } private class MockTokenRepository implements PersistentTokenRepository {