[cpp-sp COMMIT] /branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Thu Mar 15 16:57:45 2012
New Revision: 3592

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3592&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-400

Modified:
    branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp

Modified: branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp?rev=3592&r1=3591&r2=3592&view=diff
==============================================================================
--- branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp (original)
+++ branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp Thu Mar 15 16:57:45 2012
@@ -1274,9 +1274,11 @@
                     }
                 }
                 else {
-                    // Session's gone, so...
-                    sessionsKilled.push_back(key.string());
-                    key.destroy();
+                    // Session may already be gone, or it may be associated with a different application.
+                    // To be conservative, we'll leave it alone. This isn't really increasing our security
+                    // risk, because if we can't lookup the session, it's unlikely the calling logout code
+                    // can either, so there's no chance of removing the session anyway.
+                    m_log.warn("session (%s) not accessible for logout, may be gone, or associated with a different application", key.string());
                 }
                 key = sessions.next();
             }
@@ -1512,7 +1514,7 @@
     }
 
     if (!XMLString::equals(session->getApplicationID(), app.getId())) {
-        m_log.error("an application (%s) tried to access another application's session", app.getId());
+        m_log.warn("an application (%s) tried to access another application's session", app.getId());
         session->unlock();
         return nullptr;
     }