ERROR attempting to call HttpSession.invalidate () in TOMCAT 5.5.9

Question

Can someone help me with this TOMCAT issue:-
I am attempting to implement a logout method that will invalidate the current session and redirect to the login page (based on SRLogout demo eg).
The code works fine in JDeveloper Embedded OC4J Server, but when i deploy the application to Tomcat 5.5.9 it throws an exception that the Session has already been invalidated.
I also notice that When i print the session object in JDev it is: 'HTTP Session ac104af6231ccf2bd0e9a39148c5adc1ea2714432a9e' but in Tomcat it is : 'org.apache.catalina.session.StandardSessionFacade@bfb545'
See the method below and exception below :
public String logoutButton_action() throws IOException{
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContex();
HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
HttpSession session = (HttpSession)ectx.getSession(false);
session.invalidate();
response.sendRedirect("Login.jspx");
return null;
Exception
[2006-07-18 11:31:01] [ERROR] [http-8080-Processor23] (com.sun.faces.lifecycle.InvokeApplicationPhase:80) - #{backing_app_SRLogout.logoutCommandButton1_action}: javax.faces.el.EvaluationException: java.lang.IllegalStateException: getAttribute: Session already invalidated
javax.faces.FacesException: #{backing_app_SRLogout.logoutCommandButton1_action}: javax.faces.el.EvaluationException: java.lang.IllegalStateException: getAttribute: Session already invalidated
     at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:78)
     at oracle.adf.view.faces.component.UIXCommand.broadcast(UIXCommand.java:211)
     at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:267)
     at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:381)
     at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:75)
...

Answer 1

After a lot of investigation, code review and tests, I finally managed to understand what's going on with this problem.
The following stack trace is the key:
java.lang.IllegalStateException: getAttribute: Session already invalidated
     org.apache.catalina.session.StandardSession.getAttribute(StandardSession.java:1077)
     org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:110)
     oracle.adf.share.http.HttpUtil.getAttribute(HttpUtil.java:98)
     oracle.adf.share.http.HttpSessionScopeAdapter.get(HttpSessionScopeAdapter.java:240)
     oracle.adf.share.statemanager.StateManagerScopeAdapter.<init>(StateManagerScopeAdapter.java:88)
     oracle.adf.share.http.HttpStateManagerScopeAdapter.<init>(HttpStateManagerScopeAdapter.java:51)
     oracle.adf.share.http.ServletADFContext.getStateManager(ServletADFContext.java:254)
     oracle.adf.share.statemanager.StateManagerScopeAdapter$ADFScopeListenerImpl.scopeInvalidated(StateManagerScopeAdapter.java:251)
     oracle.adf.share.ADFScopeHelper.fireScopeInvalidated(ADFScopeHelper.java:53)
     oracle.adf.share.http.HttpSessionScopeAdapter.invalidate(HttpSessionScopeAdapter.java:265)
     oracle.adf.share.http.HttpSessionScopeAdapter.valueUnbound(HttpSessionScopeAdapter.java:324)
     org.apache.catalina.session.StandardSession.removeAttributeInternal(StandardSession.java:1686)
     org.apache.catalina.session.StandardSession.expire(StandardSession.java:801)
     org.apache.catalina.session.StandardSession.expire(StandardSession.java:644)
     org.apache.catalina.session.StandardSession.invalidate(StandardSession.java:1158)
     org.apache.catalina.session.StandardSessionFacade.invalidate(StandardSessionFacade.java:150)
oracle.adf.share.http.HttpSessionScopeAdapter.valueUnbound(HttpSessionScopeAdapter.java:324)*
org.apache.catalina.session.StandardSession.removeAttributeInternal(StandardSession.java:1686)*
org.apache.catalina.session.StandardSession.expire(StandardSession.java:801)*
catalina first invalidate the session by setting expire property to true
then it removes all attributes by calling removeAttributeInternal()
which calls whatever attributes valueUnbound method...
in this case, oracle's HttpSessionScopeAdapter try to get an attribute on the session
org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:110)
oracle.adf.share.http.HttpUtil.getAttribute(HttpUtil.java:98)
catalina does not permit accessing the attributes when it is invalidated... so you get the mighty java.lang.IllegalStateException: getAttribute: Session already invalidated exception...
the solution to this problem is to remove oracle attributes BEFORE invalidating the session. This should work in any appserver implementation.
For example, in our case, the oracle attribute was a scope attribute (HttpStateManagerScopeAdapter in our stack trace)... We found those attributes using the
HttpSession.getAttributeNames() method, and removed them manually before invalidating the session.
session.removeAttribute("ORA_adf_sessionScope");
session.removeAttribute("__adf_session_scope__");
// remove private attributes
// and invalidate the session
session.invalidate();
I think that it makes sense that catalina invalidates the session before any call to the listeners, because any problem in those attributes could mean an improperly invalidated session...
Cheers.