Bug #37
race condition on concurent execution of singleLogoutReturn with ID-FF 1.2
0%
Description
when using the HTTP-Get method for logout (redirection are done inside
<html:img/> tags) the redirections ends on the singleLogoutReturn callback.
Those callback load the current session dump from the session, handle the
LogoutResponse with process_response_msg which also remove an assertion from
the LassoSession object, then store the new session_dump inside the authentic
session.
If execution of the singleLogoutReturn are non concurent, everything should be
fine, but that will not be the case with the current architecture of authentic.
So at the end the state of session.lasso_session_dump will be
non-deterministic, when it should be empty.
That's not a big problem but he could bite us someday.
The solution used for SAMLv2 should be adopted, i.e. a single logout page able to do SOAP and redirect using images.
Historique
Mis à jour par Benjamin Dauvergne il y a presque 14 ans
- Statut changé de Nouveau à Résolu (à déployer)
- Version cible mis à 0.8
Fixed in the 0.8 trunk.
Mis à jour par Benjamin Dauvergne il y a plus de 10 ans
- Description mis à jour (diff)
- Statut changé de Résolu (à déployer) à Fermé