Added 2.9.2 as fix version again, because this is a serious bug and the fix is pretty simple.

We'll have a look at fixing this on 2.9.2 as it should be fairly simple.

Matthew, thank you for your efforts.

The thing is that invalidation of the session triggers the logout out of our SSO environment.
So without invalidation, a logout in confluence is not really a logout out of our system, which is a bad thing.

The issue is not that pressing anymore, because I managed to implement a plugin that listens for LogoutEvents and invalidates the session. This seems to work.

We've just ordered a commercial license for confluence and session invalidation upon logout is crucial for the integration of confluence into our production infrastructure.

Christoph, can you elaborate on the impact a bit more? In light of your comment I have increased the priority and Internal Value.

Hi,

Is there anything I can do (except for voting) that this bug gets a higher priority and is resolved sometimes soon?

We've just ordered a commercial license for confluence and session invalidation upon logout is crucial for the integration of confluence into our production infrastructure.

Thanks,
christoph

Also the user history is stored in the session and therefore exposes the names of recently visited pages to other users if the same browser is used.

Should add a session.invalidate into the LogoutAction

Obviously this only happens if you use a single browser and log in and out as a different user.

Detailed description:

1. User logs in
2. velocity file requires a property (eg. location section showing)
   1. confluence checks session and doesn't find it
   2. confluence loads preferences from user accessor (which will go to db or external user management)
   3. confluence returns the value to velocity
3. user logs out
   1. user credentials are dropped
   2. session is marked as "logged out"
   3. user preferences are not dropped from session
4. new user logs in
5. velocity file requires a property (eg. location section showing)
   1. confluence checks session and finds the old value