[RE-POST] Should re-authentication invalidate session?

Okay. I'll try again. If this isn't the appropriate list for this
type of question, please let me know.

robert


<original-message>
If I am prompted to authenticate myself by SecurityFilter,
and I am successfully authenticated, then I voluntarily
access the login page and authenticate myself as a different
user, should the session for the old user be invalidated?

The following code found in the FormAuthenticator.processLogin() prompted
me to ask this question:

if (principal != null) {
   // login successful
   // invalidate old session if the user was already authenticated
   // NOTE: we may want to check if the user re-authenticated as the same
user, currently
   // the session will be invalidated even if the user authenticates as the
same user.
   request.setUserPrincipal(principal);
   String continueToURL = getContinueToURL(request);
   // This is the url that the user was initially accessing before being
prompted for login.
   response.sendRedirect(response.encodeRedirectURL(continueToURL));
} else {
   // login failed
   // set response status and forward to error page
   response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
   request.getRequestDispatcher(errorPage).forward(request, response);
}

I don't see where the session is invalidated.
I also looked in ServletRequestWrapper.setUserPrincipal() and it doesn't
appear that
the session is invalidated there either.


robert
</original-message>



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php