From b20c0a674a65e2724221abd393e1c3b3e22aa0d1 Mon Sep 17 00:00:00 2001
From: Ray Krueger <raykrueger@users.sourceforge.net>
Date: Mon, 16 Jan 2006 23:56:04 +0000
Subject: [PATCH] Fixed NPE see SEC-143

---
 .../providers/jaas/JaasAuthenticationProvider.java          | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/org/acegisecurity/providers/jaas/JaasAuthenticationProvider.java b/core/src/main/java/org/acegisecurity/providers/jaas/JaasAuthenticationProvider.java
index 3bf523413f..14ce0b0833 100644
--- a/core/src/main/java/org/acegisecurity/providers/jaas/JaasAuthenticationProvider.java
+++ b/core/src/main/java/org/acegisecurity/providers/jaas/JaasAuthenticationProvider.java
@@ -421,8 +421,12 @@ public class JaasAuthenticationProvider implements AuthenticationProvider,
      */
     protected void handleLogout(HttpSessionDestroyedEvent event) {
         SecurityContext context = (SecurityContext) event.getSession().getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
+        if (context == null) {
+            log.debug("The destroyed session has no SecurityContext");
+            return;
+        }
         Authentication auth = context.getAuthentication();
-        if (auth instanceof JaasAuthenticationToken) {
+        if ((auth != null) && (auth instanceof JaasAuthenticationToken)) {
             JaasAuthenticationToken token = (JaasAuthenticationToken) auth;
             try {
                 LoginContext loginContext = token.getLoginContext();