[ https://jira.jboss.org/jira/browse/JBSEAM-3972?page=com.atlassian.jira.pl... ] David Croe updated JBSEAM-3972: ------------------------------- Description: Hello ! I think there is a major security bug in the seamspace example, which will give a user the permissions of the user which has been logged in before. To reproduce the scenario: 1. login as user demo. 2. click the back button or enter the login page manually in the url of your browser 3. login as another user. the second user will have the admin permissions of the demo user! Problem is that the authenticate method will not be invoked if you are already logged in ( even as another user) and the old principal with the assigned permissions will stay in memory. Greetings D.Croe was: Hello ! I think there is a major security bug in the seamspace example, which will give a user the permissions of the user which has been logged in before. To reproduce the scenario: 1. login in as user demo. 2. click the back button or enter the login page manually in the url of your browser 3. login as another user. the second user will have the admin permissions of the demo user! Problem is that the authenticate method will not be invoked if you are allready logged in ( even as another user) and the old principal with the assigned permissions will stay in memory. Greetings D.Croe -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-3972?page=com.atlassian.jira.pl... ] Shane Bryzak commented on JBSEAM-3972: -------------------------------------- I can't see how this is possible. The Identity.authenticate() method (which is the gateway for all authentication) explicitly clears the the principal and subject before doing any authentication. public synchronized void authenticate() throws LoginException { // If we're already authenticated, then don't authenticate again if (!isLoggedIn() && !credentials.isInvalid()) { principal = null; subject = new Subject(); authenticate( getLoginContext() ); } } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-3972?page=com.atlassian.jira.pl... ] Shane Bryzak reassigned JBSEAM-3972: ------------------------------------ Assignee: Shane Bryzak -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/SEAMSECURITY-7?page=com.atlassian.jira... ] Shane Bryzak updated SEAMSECURITY-7: ------------------------------------ Fix Version/s: 3.0.0.Beta1 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/SEAMSECURITY-7?page=com.atlassian.jira.pl... ] Shane Bryzak resolved SEAMSECURITY-7. ------------------------------------- Resolution: Out of Date -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira