關於resin的認證架構

在未logout的情況下，當前的使用者無法重新登入成功。查看com.caucho.server.security.FormLogin原始碼發現：

 

public Principal authenticate(HttpServletRequest request,<br />HttpServletResponse response, ServletContext application)<br />throws ServletException, IOException<br />{<br />Principal user = getUserPrincipal(request, response, application);</p><p>if (user != null)<br />return user;</p><p>String path = request.getServletPath();<br />if (path == null)<br />path = request.getPathInfo();<br />else if (request.getPathInfo() != null)<br />path = path + request.getPathInfo();</p><p>if (path.equals(""))<br />{<br />// Forward?<br />path = request.getContextPath() + "/";<br />response.sendRedirect(response.encodeRedirectURL(path));<br />return null;<br />}</p><p>Application app = (Application) application;</p><p>String uri = request.getRequestURI();</p><p>if (path.endsWith("/j_security_check"))<br />{<br />...<br />}<br />}

 

也就是說，即使使用者重新填寫登入框並提交至j_security_check，authenticate()還是優先採用已有的使用者資訊，因此新的認證校正永遠不會被調用！