(shiro) branch 3.x updated: enh: destroy existing session upon login

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch 3.x
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/3.x by this push:
     new adbbfe664 enh: destroy existing session upon login
adbbfe664 is described below

commit adbbfe66482ad9cb0b3ad7c5707ac58b0ab8e574
Author: lprimak <le...@flowlogix.com>
AuthorDate: Thu Apr 30 19:07:32 2026 -0500

    enh: destroy existing session upon login
---
 .../org/apache/shiro/mgt/DefaultSecurityManager.java |  5 +++++
 .../shiro/test/web/jakarta/WebContainerIT.java       | 20 ++++++++++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git 
a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java 
b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
index 73fdfe505..6229042b3 100644
--- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
+++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
@@ -288,6 +288,11 @@ public class DefaultSecurityManager extends 
SessionsSecurityManager {
             throw ae;
         }
 
+        Session existingSession = subject.getSession(false);
+        if (existingSession != null) {
+            existingSession.stop();
+        }
+
         Subject loggedIn = createSubject(token, info, subject);
 
         onSuccessfulLogin(token, info, loggedIn);
diff --git 
a/samples/web/src/test/java/org/apache/shiro/test/web/jakarta/WebContainerIT.java
 
b/samples/web/src/test/java/org/apache/shiro/test/web/jakarta/WebContainerIT.java
index bf28f8552..3fb8d0b8b 100644
--- 
a/samples/web/src/test/java/org/apache/shiro/test/web/jakarta/WebContainerIT.java
+++ 
b/samples/web/src/test/java/org/apache/shiro/test/web/jakarta/WebContainerIT.java
@@ -36,17 +36,13 @@ public class WebContainerIT extends 
JakartaAbstractContainerIT {
     @SuppressWarnings("checkstyle:MagicNumber")
     @Test
     public void logIn() {
-        final Client client = ClientBuilder.newClient();
-
-        try {
+        try (Client client = ClientBuilder.newClient()) {
             Cookie jsessionid;
             try (Response loginPage = client.target(getBaseUri())
                     .path("/login.jsp")
                     .request(TEXT_HTML_TYPE)
                     .get()) {
-                jsessionid = new Cookie.Builder("JSESSIONID")
-                        .value(loginPage.getMetadata().get("Set-Cookie")
-                                
.get(0).toString().split(";")[0].split("=")[1]).build();
+                jsessionid = getSessionCookie(loginPage);
                 
assertThat(loginPage.readEntity(String.class)).contains("loginform");
             }
 
@@ -57,6 +53,7 @@ public class WebContainerIT extends 
JakartaAbstractContainerIT {
                     .request(APPLICATION_FORM_URLENCODED)
                     .cookie(jsessionid)
                     
.post(Entity.entity("username=root&password=secret&submit=Login", 
APPLICATION_FORM_URLENCODED))) {
+                jsessionid = getSessionCookie(loginAction);
                 assertThat(loginAction.getStatus()).isEqualTo(302);
                 location = loginAction.getLocation();
             }
@@ -68,8 +65,15 @@ public class WebContainerIT extends 
JakartaAbstractContainerIT {
                     .cookie(jsessionid)
                     .get(String.class);
             assertThat(loggedPage).contains("Hi root!");
-        } finally {
-            client.close();
         }
     }
+
+    private static Cookie getSessionCookie(Response response) {
+        return new Cookie.Builder("JSESSIONID")
+                .value(response.getMetadata().get("Set-Cookie")
+                        .stream().map(String.class::cast)
+                        .filter(cookie -> cookie.startsWith("JSESSIONID="))
+                        .filter(cookie -> !cookie.contains("deleteMe"))
+                        .findAny().get().split(";")[0].split("=")[1]).build();
+    }
 }