keycloak-memoizeit

KEYCLOAK-1576

7/20/2015 8:35:56 AM

Stian Thorgersen

Commit: f884aed

Tree: 5f7c564

Parents: f2dee1a

Changes

services/src/main/java/org/keycloak/services/resources/LoginActionsService.java 2(+2 -0)

Details

services/src/main/java/org/keycloak/services/resources/LoginActionsService.java 2(+2 -0)

diff --git a/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java b/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
index 79d20d5..55ddb9b 100755
--- a/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
+++ b/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
@@ -623,6 +623,7 @@ public class LoginActionsService {
         if (clientSession.getAction().equals(ClientSessionModel.Action.RECOVER_PASSWORD.name())) {
             String actionCookieValue = getActionCookie();
             if (actionCookieValue == null || !actionCookieValue.equals(userSession.getId())) {
+                session.sessions().removeClientSession(realm, clientSession);
                 return session.getProvider(LoginFormsProvider.class)
                         .setSuccess(Messages.ACCOUNT_PASSWORD_UPDATED)
                         .createInfoPage();
@@ -657,6 +658,7 @@ public class LoginActionsService {
 
             String actionCookieValue = getActionCookie();
             if (actionCookieValue == null || !actionCookieValue.equals(userSession.getId())) {
+                session.sessions().removeClientSession(realm, clientSession);
                 return session.getProvider(LoginFormsProvider.class)
                         .setSuccess(Messages.EMAIL_VERIFIED)
                         .createInfoPage();