Re: session.invalidate not working

I looked through some of my code and came across the following...

             // invalidate the old session
             data.getRequest().getSession().invalidate();

             // use the sessionid from a newly created session
             sessionId = data.getSession().getId();


In another instance I am also using a slightly different variation

             try {

                         if (data.getResponse().isCommitted() == false) {
                             data.getResponse().sendRedirect(destination);
                         }

                         // invalidate this session since we are not 
going to use it anyways
                         data.getRequest().getSession().invalidate();

                         return false;

                     } catch (IOException ex) {}

I have not had problems with either of these

However, I am currently running Tomcat 6.0...

Thinking years back... one thing I did run into with this had to do with 
my setup in tomcat....


Within conf/server.xml (on my dev server) I use

<Context path="/webapp" docBase="webapp"  crossContext="true">

Within WEB-INF/web.xml I use

<servlet>
<servlet-name>
            webapp
</servlet-name>
<servlet-class>
             org.apache.turbine.Turbine
</servlet-class>

...

</servlet>

<servlet-mapping>
<servlet-name>
             webapp
</servlet-name>
<url-pattern>
             /something/*
</url-pattern>
</servlet-mapping>




On 7/18/2012 12:58 PM, Asha N wrote:
> Hello,
>
> We are using Turbine with Velocity, Javascript and Java and Tomcat 7 as our
> server. I have a use case where the session needs to be invalidated after a
> user logs in. The things that I tried are:
> * Tomcat7 by default has it turned on, but it does not work. We have another
> system with Spring instead. That generates a new jsessionid without any
> issues.
> * I tried the following code just before the user gets authenticated via:
> TurbineSecurity.getAuthenticatedUser(username, password);
> my code:
>               HttpSession session = data.getRequest().getSession(false);
> 		if (session!=null&&  !session.isNew()) {
> 		    session.invalidate();
> 		}
> 			
> 		data.getRequest().getSession(true);
>
> this does not work. I still get the same sessionid.
> I also tried:
>
> data.getSession().invalidate(), but that too does not seem to work.
>
> Any pointers or inputs are greatly appreciated.
>
> thanks in advance,
>
> Asha
>