Strange things happen with seam security

[amitev]

Hi! I have a login form and a login button when the user is logged i show a logout link that invokes #{identity.logout}. The strange thing is that after the logout is invoked the page is redisplayed but in the login form the username input field still contains the old username (#{identity.username} and when i input the password and then press the login button the page is simply redisplayed with clear login fields.
Idea where's the problem?

[amitev]

someone's there?

[azalea]

Hi,

Maybe due to "RememberMe" ?

If so, delete the cookie which name is "org.jboss.seam.security.username" in your browser.
If you don't need "RememberMe", remove the checkbox in login page.

[amitev]

Hi. I don't have rememberme checkbox on my login page.

[shane.bryzak]

Identity.logout() invalidates the session, so the username should be cleared along with everything else. Are you sure it's not your browser that's auto-completing the login form for you?

[gavin.king]

Well, actually the session isn't invalidated until the end of the request. So if you render a page with a login form on it, it will remember the username (but not the password, of course).

[amitev]

Yes. I render a page with a login form on it. Idea for workaround of this - to show a page after session invalidation?

[amitev]

The problem is that when the page is redisplayed after logout and i the submit button simply rerenders the page without invoking the login action

[amitev]

I guess i have to force a redirect but how?

[gavin.king]

Add a navigation rule in pages.xml, of course:

<navigation from-action="#{identity.logout}">
 <redirect view-id="...."/>
</navigation>

Or maybe just:

<navigation from-action="#{identity.logout}">
 <redirect/>
</navigation>

If you want to stay on the current page.

[amitev]

Works like a charm. Thank you!