SessionServlet extends HttpServlet { @Override protected void doDelete(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException { Subject subject = SecurityUtils.getSubject(); log.info("Deleting session for user: {}", subject.getPrincipal()); subject.logout(); checkState(!subject.isAuthenticated()); checkState(!subject.isRemembered()); checkState(subject.getSession(false) == null); response.setStatus(SC_NO_CONTENT); response.setHeader(X_FRAME_OPTIONS, DENY); }    }
@Test public void testDoDelete() throws Exception { when(subject.isAuthenticated()).thenReturn(false); when(subject.isRemembered()).thenReturn(false); when(subject.getSession(false)).thenReturn(null); underTest.doDelete(httpServletRequest, httpServletResponse); verify(httpServletResponse).setHeader(X_FRAME_OPTIONS, "DENY"); }