[seam-issues] [JBoss JIRA] Updated: (JBSEAM-4770) Resteasy - destroy session after request skipped

Resteasy - destroy session after request skipped ------------------------------------------------- Key: JBSEAM-4770 URL: https://issues.jboss.org/browse/JBSEAM-4770 Project: Seam Issue Type: Bug Affects Versions: 2.2.1.CR3 Reporter: Lars Huber Assignee: Jozef Hartinger Priority: Blocker Labels: resteasy Fix For: 2.2.1.Final Resteasy can be configured to destroy the websession right after the request (default behaviour). In few circumstances the session can't be destroyed anymore. Example is if using basic authentication you can access the previous authenticated session even if giving wrong credentials in request. This can end up in serious security issues. see http://seamframework.org/Community/ResteasyDestroySessionAfterRequestSeri...