req.getSession(true) does not create a new session. It will create a new session only if there is no existing session. So in your case when you do req.getSession(true) it will return a reference to the same session you had before. If you invalidate that session and then try to do stuff with the same session, it wont work. It might be a different reference to the session, but still it is pointing the session that was just invalidated.