Fixed problems with invalidating the HttpSession during a request (#10411)

Change-Id: I121d6999eababb7eaa53ba16fb8ed029cc154a12

2 files changed, 31 insertions, 5 deletions

diff --git a/server/src/com/vaadin/server/VaadinService.java b/server/src/com/vaadin/server/VaadinService.java
index 5d3f79fddb..5338ec217b 100644
--- a/server/src/com/vaadin/server/VaadinService.java
+++ b/server/src/com/vaadin/server/VaadinService.java
@@ -789,12 +789,27 @@ public abstract class VaadinService implements Serializable {
             removeClosedUIs(session);
         } else {
             if (!session.isClosing()) {
-                getLogger().fine(
-                        "Closing inactive session "
-                                + session.getSession().getId());
                 closeSession(session);
+                if (session.getSession() != null) {
+                    getLogger().fine(
+                            "Closing inactive session "
+                                    + session.getSession().getId());
+                }
+            }
+            if (session.getSession() != null) {
+                /*
+                 * If the VaadinSession has no WrappedSession then it has
+                 * already been removed from the HttpSession and we do not have
+                 * to do it again
+                 */
+                session.removeFromSession(this);
             }
-            session.removeFromSession(this);
+
+            /*
+             * The session was destroyed during this request and therefore no
+             * destroy event has yet been sent
+             */
+            fireSessionDestroy(session);
         }
     }
 
@@ -914,7 +929,7 @@ public abstract class VaadinService implements Serializable {
      * @return true if the session is active, false if it could be closed.
      */
     private boolean isSessionActive(VaadinSession session) {
-        if (session.isClosing()) {
+        if (session.isClosing() || session.getSession() == null) {
             return false;
         } else {
             long now = System.currentTimeMillis();
diff --git a/server/src/com/vaadin/server/VaadinSession.java b/server/src/com/vaadin/server/VaadinSession.java
index 205e4dc6cf..4aa2ef5d92 100644
--- a/server/src/com/vaadin/server/VaadinSession.java
+++ b/server/src/com/vaadin/server/VaadinSession.java
@@ -160,7 +160,18 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
                             "A VaadinSession instance not associated to any service is getting unbound. "
                                     + "Session destroy events will not be fired and UIs in the session will not get detached. "
                                     + "This might happen if a session is deserialized but never used before it expires.");
+        } else if (VaadinService.getCurrentRequest() != null
+                && getCurrent() == this) {
+            // There is still a request in progress for this session. The
+            // session will be destroyed after the response has been written.
+            if (!isClosing()) {
+                close();
+            }
         } else {
+            /*
+             * We are not in a request related to this session so we can
+             * immediately destroy it
+             */
             service.fireSessionDestroy(this);
         }
         session = null;