Question

This my code

if(request.getParameter("btnlogOut") != null)
   {
    session.invalidate();
   }

Its not clear the session….

Thanks

Frank

Answer 1

It does.

Most likely you’re sending a forward instead of a redirect to the result page. This way the old session variables are still accessible in EL scope. Make sure that you’re sending a redirect after the invalidate.

session.invalidate();
response.sendRedirect(request.getContextPath() + "/index.jsp");

This way the browser will be instructed to send a brand new HTTP request on the given URL without the session cookie and hence the associated servlet request-response will get a brand new HttpSession object instance.