How to check if a session is invalid

Question

How to check if a session is invalid or not? There is no method in the API.

Is it the same as isNew()? And what is the difference if not?

Answer 1

isNew() is true only if this session wasn't yet accepted by client (i.e. it was just created, and JSESSIONID wasn't sent yet, or if it was sent, client didn't send it back, so server doesn't know about it and created another session)

Answer 2

If you want to know whether it valid based on a request:

request.isRequestedSessionIdValid()

  or

HttpSession sess = request.getSession(false);
if (sess != null) {
   // it's valid
}

If you have stored a reference to the session and need to validate I would

try {
  long sd = session.getCreationTime();
} catch (IllegalStateException ise) {
  // it's invalid
}

Answer 3

For all intents and purposes, yes. However, it will throw an IllegalStateException if called on a session invalidated in the same request-response cycle.