From 1d00c5c396e9e8b20a11e2a402ad8bd88ffa2a20 Mon Sep 17 00:00:00 2001
From: lprimak <lenny@flowlogix.com>
Date: Wed, 26 Mar 2025 16:14:12 -0500
Subject: [PATCH] bugfix: catch InvalidStateException in validate()

---
 .../mgt/AbstractValidatingSessionManager.java        | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java b/core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java
index 45e57f3bac..d289660674 100644
--- a/core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java
+++ b/core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java
@@ -140,10 +140,18 @@ protected void validate(Session session, SessionKey key) throws InvalidSessionEx
         try {
             doValidate(session);
         } catch (ExpiredSessionException ese) {
-            onExpiration(session, ese, key);
+            try {
+                onExpiration(session, ese, key);
+            } catch (IllegalStateException eise) {
+                LOGGER.trace("Attempting to validate an expired session with key {}", key, eise);
+            }
             throw ese;
         } catch (InvalidSessionException ise) {
-            onInvalidation(session, ise, key);
+            try {
+                onInvalidation(session, ise, key);
+            } catch (IllegalStateException eise) {
+                LOGGER.trace("Attempting to validate session with key {}", key, eise);
+            }
             throw ise;
         }
     }