Minor A call to @@login resets the authentication.
Then, it performs the login if it founds the required parameters: username, passward and caller.
It uses:
org.nuxeo.ecm.webengine.login.WebEngineFormAuthenticator.handleRetrieveIdentity(HttpServletRequest, HttpServletResponse) {
if (!isLoginRequest(httpRequest)) {
return null;
}
String userName = httpRequest.getParameter(usernameKey);
String password = httpRequest.getParameter(passwordKey);
return new UserIdentificationInfo(userName, password);
}
But the method returns an identity even if the username parameter is not present.
It causes a NPE when loging out on the NuxeoAuthenticationFilter which expects a valid identity with a username.
Currently line 507
if (cachableUserIdent == null || cachableUserIdent.getUserInfo() == null) {
UserIdentificationInfo userIdent = handleRetrieveIdentity(httpRequest, httpResponse);
if (userIdent != null && userIdent.getUserName().equals(getAnonymousId())) { <=== HERE