[ https://issues.jboss.org/browse/WFLY-4810?page=com.atlassian.jira.plugin.... ] Stuart Douglas commented on WFLY-4810: -------------------------------------- It looks like this can be reproduced reliably by putting a thread.sleep() in io.undertow.security.impl.FormAuthenticationMechanism#sendChallenge(), just before the return statement. Basically I think there is a race with the response being returned and the cache data being committed. The client will see the response being done as soon as Undertow has served the page, however the request is not done on the server side until the call stack has returned. If the client immediately makes a second request it is possible for this request to hit the server before the first request is done from the servers point of view. I am not sure if there is much that can be done other than adding a short Thread.sleep() to the test to make sure the cache data is committed. -- This message was sent by Atlassian JIRA (v6.3.15#6346)