refresh for invalidated user session

[Alessandro Ilardo]

hi there,
on a servlet I've got an action which invalidates the user session

request.getSession().invalidate();

on an included jsp fragment, I've got the following code which simple tells me what's the user role (if he has it).

<%@ taglib uri="http://jakarta.apache.org/taglibs/request-1.0" prefix="req" %>
 
<c:set var="role" value="none"/>
<req:isUserInRole role="user">
    <c:set var="role" value="user"/>
</req:isUserInRole>

The first time I call the servlet the jsp page still shows me that the user is looged in, but if I call it again, then it correctly shows the user is not authenticated.
I'm pretty sure that the servlet does its job, because If I call the protected resources it asks me again to log me in. It actually looks like the jsp page needs a refresh.

Any suggestions?
Thanks in advance.

[Bear Bibeault]

What's the relation ship between the servelt and the included JSP fragment. At what point in the process do you check the session for validity?

[Alessandro Ilardo]

it just switch the login or logout link. It doesn't any business logic.
That's why it keeps showing me the logout link even If I already made it.

[Shiva Battula]

I have seen this kinda behaviour with struts.
1. try request.getSession().invalidateSession() in JSP itself. It is not a good practice.
2. request.getSession(true). it will also create new session so that old session wont exists. bit better practice.

[Bear Bibeault]

"Shiv",

There aren't many rules that you need to worry about here on the Ranch, but one that we take very seriously regards the use of proper names. Please take a look at the JavaRanch Naming Policy and adjust your display name to match it.

In particular, your display name must be a first and a last name separated by a space character, and must not be obviously fictitious.

Thanks!
bear
JavaRanch Sheriff