You don't need to get the session on every page in order to read it's
contents.  JSP's are smart enough to know 'session.whatEver()' refers to the
current session without instantiating a session object.

This is what I do to test for an expired session and send the user to a
timeout page. (As this is a JSP list I'll assume you're doing this through
scripting in JSP's):

String emplNumber = (String)session.getAttribute("employee");
if (emplNumber == null) {
%>
    <jsp:forward page="timeout.jsp"/>
<%
}

If you just want to expire the session when the 'beanie' attribute is not
missing, do this:

BeanName bn = (BeanName) session.getAttribute("beanie");
if (bn != null)
{
  session.invalidate();
%>
    <jsp:forward page="OuttaHere.html"/>
<%
}

Invalidating the session also removes any objects in that session, so you
don't need to explicitly remove "beanie".

Greg


-----Original Message-----
From: lior@f... [mailto:lior@f...]
Sent: Wednesday, October 09, 2002 10:15 PM
To: Pro_JavaServer_Pages
Subject: [pro_jsp] JSP and Oracle JDeveloper


We're running Oracle JDeveloper to test out our application. When we want
the user to log out of the system we invalidated the session.

HttpSession sess = request.getSession(false);
// so as not to create a new session
BeanName bn = (BeanName) sess.getAttribute("beanie");

if (bn != null)
{
  sess.removeAttribute("beanie");
  sess.invalidate();
  response.sendRedirect("OuttaHere.html");
}

Once we are in the html page and try to log in again, we a
NullPointerException thrown with oracle.jsp...JspRequestContext and the
page cannot be dispatched.

I was wondering if this is a JDeveloper error or are we doing something
else wrong to eliminate the session and the object that are bound to it.

Also, another question. Is is better to have getSession(true) for all
pages or just the page that processes the username and password and all
pages after that have a false for their boolean value?

Thank you.

Lior Shliechkorn