Problems invalidating and then re-creating a session

["Nosonowitz, Phil" <ph...@gs.com>]

The following code snippet, which creates a session, invalidates the
session, then creates a new session does not work in Tomcat 3.2 beta 6, but
does under JRun and WebLogic....(NOTE:In the actual program, session
invalidation and re-creation is being used as a quick way to clean out the
users state).

<%
// ----------------------------------
// get the current session...
// ----------------------------------
HttpSession mySession = request.getSession();
out.println(mySession + "<br>");
out.println("1st session created: " + new Date(mySession.getCreationTime())
+ "<br>");
out.println("1st SessionId:" + request.getRequestedSessionId() + "<br>");
mySession.setAttribute("Att1", "Hello");
out.println(mySession.getAttribute("Att1") + "<br>");

// ----------------------------------
// invalidate the current session
// ----------------------------------
mySession.invalidate();
out.println("Session Invalidated!<br>");

// ----------------------------------
// create a new session
// ----------------------------------
mySession = request.getSession(true);
out.println(mySession + "<br>");
out.println("2nd session created: " + new Date(mySession.getCreationTime())
+ "<br>");
out.println("2nd SessionId:" + request.getRequestedSessionId() + "<br>");
mySession.setAttribute("Att1", "Hello");
out.println(mySession.getAttribute("Att1") + "<br>");
%>

An exception is thrown by Tomcat when "mySession.getCreationTime()" is
called after creating the new session:

Internal Servlet Error:
javax.servlet.ServletException: getCreationTime: Session already invalidated
	at
org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImp
l.java:449)
	at
_0002fSessionTest_0002ejspSessionTest_jsp_6._jspService(_0002fSessionTest_00
02ejspSessionTest_jsp_6.java:94)
	at
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:119)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
	at
org.apache.jasper.servlet.JspServlet$JspServletWrapper.service(JspServlet.ja
va:177)
	at
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:309)
	at org.apache.jasper.servlet.JspServlet.service(JspServlet.java,
Compiled Code)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
	at
org.apache.tomcat.core.ServletWrapper.doService(ServletWrapper.java:387)
	at org.apache.tomcat.core.Handler.service(Handler.java, Compiled
Code)
	at
org.apache.tomcat.core.ServletWrapper.service(ServletWrapper.java, Compiled
Code)
	at
org.apache.tomcat.core.ContextManager.internalService(ContextManager.java,
Compiled Code)
	at
org.apache.tomcat.core.ContextManager.service(ContextManager.java, Compiled
Code)
	at
org.apache.tomcat.service.http.HttpConnectionHandler.processConnection(HttpC
onnectionHandler.java, Compiled Code)
	at
org.apache.tomcat.service.TcpWorkerThread.runIt(PoolTcpEndpoint.java,
Compiled Code)
	at
org.apache.tomcat.util.ThreadPool$ControlRunnable.run(ThreadPool.java,
Compiled Code)
	at java.lang.Thread.run(Thread.java:479)
Root cause: 
java.lang.IllegalStateException: getCreationTime: Session already
invalidated
	at
org.apache.tomcat.session.StandardSession.getCreationTime(StandardSession.ja
va, Compiled Code)
	at
org.apache.tomcat.facade.HttpSessionFacade.getCreationTime(HttpSessionFacade
.java:118)
	at
_0002fSessionTest_0002ejspSessionTest_jsp_6._jspService(_0002fSessionTest_00
02ejspSessionTest_jsp_6.java:82)
	at
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:119)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
	at
org.apache.jasper.servlet.JspServlet$JspServletWrapper.service(JspServlet.ja
va:177)
	at
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:309)
	at org.apache.jasper.servlet.JspServlet.service(JspServlet.java,
Compiled Code)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
	at
org.apache.tomcat.core.ServletWrapper.doService(ServletWrapper.java:387)
	at org.apache.tomcat.core.Handler.service(Handler.java, Compiled
Code)
	at
org.apache.tomcat.core.ServletWrapper.service(ServletWrapper.java, Compiled
Code)
	at
org.apache.tomcat.core.ContextManager.internalService(ContextManager.java,
Compiled Code)
	at
org.apache.tomcat.core.ContextManager.service(ContextManager.java, Compiled
Code)
	at
org.apache.tomcat.service.http.HttpConnectionHandler.processConnection(HttpC
onnectionHandler.java, Compiled Code)
	at
org.apache.tomcat.service.TcpWorkerThread.runIt(PoolTcpEndpoint.java,
Compiled Code)
	at
org.apache.tomcat.util.ThreadPool$ControlRunnable.run(ThreadPool.java,
Compiled Code)
	at java.lang.Thread.run(Thread.java:479)


I do not see anything in the Servlet 2.2. spec that addresses this.....
Is this entirely up to the vendor ?
Any thoughts???

Re: Problems invalidating and then re-creating a session

["Craig R. McClanahan" <Cr...@eng.sun.com>]

"Nosonowitz, Phil" wrote:

> The following code snippet, which creates a session, invalidates the
> session, then creates a new session does not work in Tomcat 3.2 beta 6, but
> does under JRun and WebLogic....(NOTE:In the actual program, session
> invalidation and re-creation is being used as a quick way to clean out the
> users state).
>

A patch for this problem has been committed recently, so it is fixed in beta 7,
which will appear soon (as soon as I stop finding critical bugs that really
should be fixed :-).

Craig McClanahan