Add missing remove from store
@@ -182,8 +182,7 @@ public class SessionHandlerImpl implements SessionHandler {
doGetSession(vertx, System.currentTimeMillis(), sessionID, resultHandler);
}
- private void doGetSession(Vertx vertx, long startTime, String sessionID,
- Handler<AsyncResult<Session>> resultHandler) {
+ private void doGetSession(Vertx vertx, long startTime, String sessionID, Handler<AsyncResult<Session>> resultHandler) {
sessionStore.get(sessionID, res -> {
if (res.succeeded()) {
if (res.result() == null) {
@@ -262,6 +261,16 @@ public class SessionHandlerImpl implements SessionHandler {
} else {
// invalidate the cookie as the session has been destroyed
context.removeCookie(sessionCookieName);
+
+ // if the session was regenerated in the request
+ // the old id must also be removed
+ if (session.isRegenerated()) {
+ sessionStore.delete(session.oldId(), res -> {
+ if (res.failed()) {
+ log.error("Failed to delete old session", res.cause());
+ }
+ });
+ }
// delete from the storage
sessionStore.delete(session.id(), res -> {
if (res.failed()) {
