Search code examples
sessionjakarta-eeshirohttpsession

Shiro: Cannot invalidate HttpSession

I have a Shiro session (id=11111) and a http session (id=22222).

When I try to invalidate the HttpSession, the wrong id is used.

Code:

public void logout() {
      SecurityUtils.getSubject().logout();

// exception is thrown in this line
FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
    }

Exception:

java.lang.IllegalStateException:
 org.apache.shiro.session.UnknownSessionException:
 There is no session with id [22222]

How can I invalidate the HttpSession or rather set the correct id?

Solution

  • The problem was solved by implementing a HttpSessionBindingListener and create a mapping of Shiro sessions to http sessions.