I fixed the issue by checking if the session was authorised.

However I was thinking - it seems that most of the plugins do this check (session.isAuthorized()) because most of the plugins should/could handle only packets from authorised sessions so maybe we reverse the checking and we could specify plugins that can actually handle not authorised packets (mostly authentication plugins) and in rest of plugins we could assume that the session is actually authorised? What do you think @andrzej.wojcik ?

@wojtek Your idea that most of processors require authorized session is OK. However, the issue here is that each processor has its own queue of packets to process and its own threads leading to concurrency issues, ie. packet can be for session which is authorized, it is added for correct processor but in the meanwhile other processor may deauthenticate session leading to processing packet for unauthorized session by processor requiring authorized session.

I'd say that this issue stresses having dedicated "authenticated processes" even more as we would avoid issue that something de-authenticated the session while processing certain stanza.