diff --git a/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java b/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java index e88b1dc8b3..055bbb784e 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java +++ b/web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java @@ -142,7 +142,10 @@ public class PersistentTokenBasedRememberMeServices extends AbstractRememberMeSe @Override public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { super.logout(request, response, authentication); - tokenRepository.removeUserTokens(authentication.getName()); + + if (authentication != null) { + tokenRepository.removeUserTokens(authentication.getName()); + } } protected String generateSeriesData() { diff --git a/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java b/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java index 2126d5a550..7b4375876b 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServicesTests.java @@ -121,6 +121,9 @@ public class PersistentTokenBasedRememberMeServicesTests { Cookie returnedCookie = response.getCookie("mycookiename"); assertNotNull(returnedCookie); assertEquals(0, returnedCookie.getMaxAge()); + + // SEC-1280 + services.logout(request, response, null); } private class MockTokenRepository implements PersistentTokenRepository {