Good catch. We should. I thought I had that there!
On Jan 7, 2013 5:00 AM, "LELEU Jérôme" <notifications@github.com> wrote:

> In
> cas-client-core/src/main/java/org/jasig/cas/client/session/SingleSignOutHandler.java:
>
> > @@ -128,7 +134,11 @@ public boolean isLogoutRequest(final HttpServletRequest request) {
> >       * @param request HTTP request containing an authentication token.
> >       */
> >      public void recordSession(final HttpServletRequest request) {
> > -        final HttpSession session = request.getSession(true);
> > +        final HttpSession session = request.getSession(this.eagerlyCreateSessions);
> > +
> > +        if (session == null) {
> > +            log.debug("No session currently exists (and none created).  Cannot record session information for single sign out.");
>
> Shouldn't we do a return ; here as we can't work with a null session ?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/Jasig/java-cas-client/pull/31/files#r2562799>.
>
>