Not able to invalidate session

Question

I am storing an attritbute in a session as set.setAttribute and do sessionName.invalidate() when I hit logout. However, next time when I access the servlet, I am still able to retrieve the value of the attribute set last time which should be null. Please let me know the plausible reason for not getting the desired behaviour.

Answer 1

The defined behaviour for HttpSession.invalidate() is to make the session invalid and unbind all objects. However, this depends on the implementation provided by the servlet container. Some servlet containers actually retain the session attributes even after the session has been invalidated.
One way of getting around this is to close the browser window and open a new one using some gawky scripting. Someone suggested to me sometime ago that a response.sendRedirect() to some logout page would also help.