CMS user in SSO handshake between HST and CMS is not always reset after logging in into cms with different user

The HstCmsSecurityValve contains:

String cmsUser = servletRequest.getHeader("CMS-User");
if (cmsUser != null) {
String currentCmsUser = (String) session.getAttribute(CMS_USER_ID_ATTR);
if (currentCmsUser != null && !currentCmsUser.equals(cmsUser))

{ session.removeAttribute(CMS_USER_ID_ATTR); session.removeAttribute(ContainerConstants.CMS_SSO_REPO_CREDS_ATTR_NAME); session.removeAttribute(ContainerConstants.CMS_SSO_AUTHENTICATED); }

}

The problem is that if you login into the cms as 'editor' and then do something in targeting, you get a handshake with the HST that stores the 'editor' credentials encrypted.

Now, after you logout in the cms, the HST http session is not invalidated.

After logging in into the CMS as admin, and you go to the RTVa, and modify some stuff, the HST will still have the 'editor' use in its session. Most likely, it gets fixed after you visit the channel manager some channel, as this sends a 'CMS-User' header, which triggers the above code to clear some attributes.

Since the targeting perspective in general does not send this CMS-User header, it now can become very confusing

CMS most likely needs one central plugin that arranges the handshake with the HST