This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 2558789ea8a3f43aed90bd72abf23440e19c6577 Author: lprimak <[email protected]> AuthorDate: Sun Mar 15 19:05:13 2026 -0500 bugfix: logout is not blocked if it's remembered request even if resubmitted --- .../jakarta-ee/src/main/java/org/apache/shiro/ee/filters/Forms.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/Forms.java b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/Forms.java index 42ba0a85a..1784095be 100644 --- a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/Forms.java +++ b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/Forms.java @@ -198,7 +198,8 @@ public class Forms { */ public static void logout(HttpServletRequest request, HttpServletResponse response, FallbackPredicate useFallback, String fallbackPath) { - if (!Boolean.TRUE.toString().equals(request.getHeader(FORM_IS_RESUBMITTED))) { + if (SecurityUtils.getSubject().isRemembered() + || !Boolean.TRUE.toString().equals(request.getHeader(FORM_IS_RESUBMITTED))) { SecurityUtils.getSubject().logout(); FormResubmitSupport.redirectToView(request, response, useFallback, fallbackPath); }
