Java Development Tools

We are using jdeveloper 11.1.1.7

We have run into this strange issue while executing logout action. We have the following code for logout which is called from <af:commandLink> action property.

FacesContext fc = FacesContext.getCurrentInstance();

ExternalContext ec = fc.getExternalContext();

HttpServletRequest req = (HttpServletRequest) ec.getRequest();

HttpServletResponse res = (HttpServletResponse) ec.getResponse();

HttpSession ses = (HttpSession) req.getSession(false);

ses.invalidate();

res.sendRedirect(target);

fc.responseComplete();

So first time when the application loads, we checked from the weblogic console that, sessions=1 and total sessions=1. After logout, we see that sessions=1 and total sessions=2, which tells us that the existing session was invalidated but a new session was created. We created a HttpSessionListener and a HttpSessionAttributeListener to check at what point a new session is being created and found, during the session.invalidate call "oracle.adf.share.http.HttpSessionScopeAdapter" is set as an attribute to session which is possibly creating the new session. After putting a breakpoint in the attributeAdded method of HttpSessionAttributeListener, we found the stack trace as follows:

From the stack trace it appeared that the valueUnbound method of HttpBindingContext is the triggering point of this new session being created. Note that we do not use data controls to connect to database tables in our project and we fetch data manually using jdbc. However we use contextual events and I believe that the handlers of these events are registered in data control config files. So I added the following lines, just before the session.invalidate to explicitly release the bindings:

            ValueBinding vb = fc.getCurrentInstance().getApplication().createValueBinding("#{data}");

            BindingContext bc = (BindingContext)vb.getValue(fc.getCurrentInstance());

            bc.release();

After this we found that the  session attribute "oracle.adf.share.http.HttpSessionScopeAdapter" is no longer being set, and a new session is not being created at that point. However after executing all the lines of code in the logout method, again a new session is being created. The stack trace as follows:

I suspected that the response.sendRedirect may be creating this new session but even after I commented this code, it does not make any difference and still a new session is being created. I have verified from Chrome console that we are not sending a duplicate request by mistake either.

Any ideas on what is actually creating this new session after session.invalidate? Any help is greatly appreciated.

Thanks