title: Session existing even after invalidating it
body: <p>I have basic login-logout session management problem.
  When i click login button, this function below gets triggered.After LDAP authentication, it moves to index.html where I display their name.  </p>
  
  <pre><code> function validate()
              {
                  var pageTitle=$(document).attr('title');
                  var un=document.getElementById('username').value;
                  var pwd=document.getElementById('pass').value;
                  $.ajax({
                      'url':'/analytics_1/validate',
                      'data':'userName='+un+'&amp;password='+pwd,
                      'type':'GET',
                      'success':function(response)
                      {
                          if(response==1)
                          {
                              $.ajax({
                                  'url':'/analytics_1/LogButton',
                                  'type':'POST',
                                  'data':'userName='+un+'&amp;buttonId=VIKALPLoginButton&amp;pageTitle='+pageTitle,
                                  'success':function()
                                  {
                                      window.open("index.html","_self");
                                  }
                                  });
  
                          }
                          else
                          {
                              alert("Invalid Credentials");
                          }
                      }
                  });
              }
  </code></pre>
  
  <p>I create the Session in LogButton.java after checking if it's new</p>
  
  <pre><code>if(session.isNew())
              {
                  System.out.println("session is not set, lets create the name");
                  associate=req.getParameter("userName");
                  session.setAttribute("Associate",associate);
              }
              else
              {
                  System.out.println("session is already set, lets get the name");
                  associate=(String)session.getAttribute("Associate");
              }
  </code></pre>
  
  <p>I get their name from the session I created after successful login</p>
  
  <p>And I do some actions and logout,</p>
  
  <pre><code>$('#logout').on('click',function()
          {
              var pageTitle=$(document).attr('title');
              $.ajax({
                      'url':'/analytics_1/LogButton',
                      'data':'buttonId=VIKALPLogoutButton&amp;pageTitle='+pageTitle,
                      'type':'POST',
                      'success':function()
                      {
                          window.open('Login.html',"_self");
                      },
                      'error':function(err)
                      {
                          alert("haha:"+err.response);
                      }
              });
          });
  </code></pre>
  
  <p>In LogButton.java, I check if button is VIKALPLogoutButton, if true, i proceed to invalidate the session and remove Attribute</p>
  
  <pre><code>if(button.equals("VIKALPLogoutButton"))
              {
                  System.out.println("deleting the session cuz of logout");
                  session.removeAttribute("Associate");
                  session.invalidate();
                  //System.out.println("what happens to the session? " +session.isNew());
              }
  </code></pre>
  
  <p>All these happen as per required. Now comes the security use case : What should happen if I go to index.html without logging in?</p>
  
  <p>So I started checking if session is set or not when index.html loads,</p>
  
  <pre><code>$(document).ready(function () {
  $.ajax({
                  'url':'/analytics_1/GetAssocId',
                  'type':'POST',
                  'success':function(response)
                  {
                      if(response!="null")
                          {}
                      else
                      {
                          window.open("Login.html","_self");
                      }
                      $('#name').text(response);
                  }
              });
  .....
  .....
  }
  </code></pre>
  
  <p>GetAssocId.java:</p>
  
  <pre><code>public void doPost(HttpServletRequest req,HttpServletResponse res) throws ServletException,IOException
  {
      HttpSession session=req.getSession();
      PrintWriter out=res.getWriter();
      out.print(session.getAttribute("Associate"));
  }
  </code></pre>
  
  <p>This also works fine, i.e it redirects me to Login.html if the session isn't created.</p>
  
  <p>Now the thing is, I cannot Login, even after providing valid credentials, somehow the "Associate" attribute is set to null,</p>
  
  <p>Below is the System.out.println output that I get in cmd
  <a href="https://i.stack.imgur.com/953Qj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/953Qj.png" alt="enter image description here"></a></p>
  
  <p>Above white line: Login,Logout action (notice the session invalidate output that I've given)</p>
  
  <p>Below white line: Go directly to index.html, it redirects to Login.html, and you Login with your valid credentials,</p>
  
  <p>Now this is my problem, It invalidates the session, yet still it says session is already existing . Even more confusing is, session is existing, but the value is null.</p>
  
  <p>How do I overcome this problem? Please help</p>
  
  <p>P.S:Other than the snippets I've provided for LogButton.java are not significant for this problem</p>