request.getUserPrincipal() is still not null after session is invalidated

Question

I have web application deployed on websphere application server 7.0. User logins using /j_security_check. When session timeout occures session ivnvalidates but request.getUserPrincipal() is still not null. I expect it should be null. How to clean user principal?

Answer 1

I have found solution in sphere documentation.

1. In the administrative console, click Security > Global security.
2. Under Custom properties, click New.
3. In the Name field, enter com.ibm.ws.security.web.logoutOnHTTPSessionExpire.
4. In the Values field, enter true.
5. Click Apply and Save to save the changes to your configuration.
6. Resynchronize and restart the server.