From 9ccaf05cc7cf3d03a935b1a1ba99b0e2b1004ac8 Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Fri, 25 Nov 2005 04:38:18 +0000
Subject: [PATCH] SEC-112: Bug when SecurityEnforcementFilter used with
 disabled Authentication and remember-me services.

---
 .../intercept/web/SecurityEnforcementFilter.java              | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java b/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
index e562d00931..136ffb0c8f 100644
--- a/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
+++ b/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
@@ -278,6 +278,10 @@ public class SecurityEnforcementFilter implements Filter, InitializingBean {
             ((HttpServletRequest) request).getSession().setAttribute(AbstractProcessingFilter.ACEGI_SECURITY_TARGET_URL_KEY,
                 targetUrl);
         }
+        
+        // SEC-112: Clear the SecurityContextHolder's Authentication, as the
+        // existing Authentication is no longer considered valid
+        SecurityContextHolder.getContext().setAuthentication(null);
 
         authenticationEntryPoint.commence(request,
             (HttpServletResponse) fi.getResponse(), reason);