Sergey Klimenko (Migrated from SEC-1770) said:
It seems that refreshLastRequest(String sessionId) in the SessionRegistry class is not called by the security framework anywhere, but refreshLastRequest() is called on the SessionInformation object instead. It took me a few minutes to figure out why the last refresh date wasn't being updated on my custom session registry.
Luke Taylor said:
Thanks for the report. I've updated the filter to call the SessionRegistry rather than the SessionInformation object.
Sergey Klimenko said: