From 43f0e111067dec72f2a496ad7d9df9fc10de43dc Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Fri, 5 Mar 2010 00:07:35 +0000
Subject: [PATCH] SEC-1429: Removed cached authentication from session after
 successful authentication.

---
 ...uestAwareAuthenticationSuccessHandler.java |  3 ++-
 ...SimpleUrlAuthenticationSuccessHandler.java | 22 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java b/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java
index 05052fef00..a68f6f1405 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java
@@ -46,7 +46,6 @@ import org.springframework.util.StringUtils;
  * </li>
  * </ul>
  *
- *
  * @author Luke Taylor
  * @since 3.0
  */
@@ -73,6 +72,8 @@ public class SavedRequestAwareAuthenticationSuccessHandler extends SimpleUrlAuth
             return;
         }
 
+        clearAuthenticationAttributes(request);
+
         // Use the DefaultSavedRequest URL
         String targetUrl = savedRequest.getRedirectUrl();
         logger.debug("Redirecting to DefaultSavedRequest Url: " + targetUrl);
diff --git a/web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationSuccessHandler.java b/web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationSuccessHandler.java
index 05e91eaa01..7770b8d34d 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationSuccessHandler.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationSuccessHandler.java
@@ -5,8 +5,10 @@ import java.io.IOException;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 
 import org.springframework.security.core.Authentication;
+import org.springframework.security.web.WebAttributes;
 
 /**
  * <tt>AuthenticationSuccessHandler</tt> which can be configured with a default URL which users should be
@@ -30,9 +32,29 @@ public class SimpleUrlAuthenticationSuccessHandler extends AbstractAuthenticatio
         setDefaultTargetUrl(defaultTargetUrl);
     }
 
+    /**
+     * Calls the parent class {@code handle()} method to forward or redirect to the target URL, and
+     * then calls {@code clearAuthenticationAttributes()} to remove any leftover session data.
+     */
     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
             Authentication authentication) throws IOException, ServletException {
 
         handle(request, response, authentication);
+        clearAuthenticationAttributes(request);
+    }
+
+    /**
+     * Removes temporary authentication-related data which may have been stored in the session
+     * during the authentication process.
+     */
+    protected final void clearAuthenticationAttributes(HttpServletRequest request) {
+        HttpSession session = request.getSession(false);
+
+        if (session == null) {
+            return;
+        }
+
+        session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
+        session.removeAttribute(WebAttributes.LAST_USERNAME);
     }
 }