From 63de886e5d81e802ce317b4f26d8f01cea297059 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 2 Oct 2022 11:20:04 -0700
Subject: [PATCH] GUACAMOLE-1224: Ensure all user sessions are explicitly
 invalidated prior to application shutdown.

---
 .../org/apache/guacamole/rest/auth/HashTokenSessionMap.java | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
index a344ab911..24f653098 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
@@ -225,7 +225,13 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
     @Override
     public void shutdown() {
+
+        // Terminate the automatic session invalidation thread
         executor.shutdownNow();
+
+        // Forcibly invalidate any remaining sessions
+        sessionMap.values().stream().forEach(GuacamoleSession::invalidate);
+
     }
 
 }