Jasig/java-cas-client — pull request #17 by ecki (2012-09-21 00:29:31+00:00)
Title: Retrieve Assertion in AuthenticationFilter securely from request or session

I just had the problem while playing around with some sample servlets that I tried to get rid of the session registered assertion by overwriting it. This caused a nasty CastException which I (as a user) could not get rid of without deleting my session cookie.

This (and some other conditions) can be avoided by falling back to unauthenticated state instead of puking up.

This patch also avoids creating a session if not needed, and it inspects the attributes of the request (which allows to use it in a useSession=false situation even after the validation filter).

On the fly I also expanded the javadoc for the parameters.