How to prevent session attributes from persisting on the server?

Question

I'm new to java web development. I have created a servlet/jsp web application that is deployed on Tomcat 7 . After authentication, the user go through few page that has its own forms. The inputs are stored as session attributes and are displayed on a confirmation before log out.

For the log out, I used session.invalidate() and sendRedirect("Logout.jsp") .

If I run the application again, it will return my new input, but it will also copy all the old session input.

I have disabled the session persistence and put the context cachingAllowed="false" .

It seems that all the session attributes are stored in the server memory. Is this problem causes by the server configuration?

Answer 1

Make sure you use request.getSession(boolean b) method and not the request.getSession()

All page that should be accessible to logged in user should make a call to request.getSession(false)

If call to this method does not return any session, user should be redirected to login.

Answer 2

make sure your information store in session like this:

HttpSession session = request.getSession();
session.setAttribute("info", info);

when you want to remove it,you should do it like this:

HttpSession session = request.getSession();
session.removeAttribute("info");