Question

I opened the session in my servlet when the user performed a successful login:

HttpSession session = request.getSession(true);
session.setAttribute("name", name);

then I wrote in the logout.jsp to terminate the session:

<%session.invalidate();%>

To check if a session is valid I am doing this:

HttpSession session = request.getSession();
String name = (String) session.getAttribute("name");

But it is not working, I am getting the session valid even after the session.invalidate.
Does anyone understand where am I doing wrong?

Answer 1

you should call session.getSession(false) – which returns null if there is no current session.

according to docs

HttpSession#getSession(boolean create) – create – true to create a new session for this request if necessary; false to return null if there’s no current session.

So the correct way of session value check would –

HttpSession session = request.getSession(false);
if(session!=null)
  session.setAttribute("name", name);

and once you invalidate the session –

HttpSession session = request.getSession(false);
if(session!=null)
session.invalidate();