trouble logging out w/ Spring...

I'm getting an IllegalStateException when logging out.  I believe
SecurityFilter is trying to create a session after I've invalidated
the user's session and committed the response to my "You have been
logged out" page.  I'm wondering if anyone has seen this before.  Here
is my stack trace:

java.lang.IllegalStateException: 
Cannot create a session after the response has been committed
org.apache.coyote.tomcat5.CoyoteRequest.doGetSession(CoyoteRequest.java:2270)
org.apache.coyote.tomcat5.CoyoteRequest.getSession(CoyoteRequest.java:2116)
org.apache.coyote.tomcat5.CoyoteRequestFacade.getSession(CoyoteRequestFacade.java:526)	org.apache.coyote.tomcat5.CoyoteRequestFacade.getSession(CoyoteRequestFacade.java:531)	org.securityfilter.filter.SecurityRequestWrapper.getUserPrincipal(SecurityRequestWrapper.java:208)	org.springframework.web.servlet.FrameworkServlet.getUsernameForRequest(FrameworkServlet.java:365)
org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:348)
javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
org.securityfilter.filter.SecurityFilter.doFilter(SecurityFilter.java:182)

My web.xml has one filter and one servlet:

<filter>
  <filter-name>Security Filter</filter-name>
  <filter-class>org.securityfilter.filter.SecurityFilter</filter-class>
  <init-param>
    <param-name>config</param-name>
    <param-value>/WEB-INF/security-filter.xml</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>Security Filter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<servlet>
  <servlet-name>action</servlet-name>
  <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
  <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
  <servlet-name>action</servlet-name>
  <url-pattern>*.html</url-pattern>
</servlet-mapping>

My security filter config looks like this:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Users Only</web-resource-name>
    <url-pattern>/secure/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>user</role-name>
  </auth-constraint>
</security-constraint>

<login-config>
  <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/loginForm.html</form-login-page>
      <form-error-page>/loginForm.html?denied=true</form-error-page>
      <form-default-page>/secure/birthdayList.html</form-default-page>
    </form-login-config>
</login-config>

Logout requests get sent to loginForm.jsp?logout=true, which has the
following section:

<c:if test="${not empty param.logout}">
  <%session.invalidate();%>
  <fmt:message key="login.loggedOut"/>
</c:if>

The session _is_ being invalidated.  I believe the exception is being
thrown when this page's response is being sent through the outbound
end of Security Filter's filter.  Am I right?  What can I do about it?

Thanks,
     Brian Kuhn


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/