Deploy attached war Go to http://localhost:8080/session-invalidation-1.0-SNAPSHOT/session-creation to create a session Navigate to http://localhost:8080/session-invalidation-1.0-SNAPSHOT/session-check - It has a 5 seconds sleep. Before the sleep finishes... Open http://localhost:8080/session-invalidation-1.0-SNAPSHOT/session-invalidation in another tab in order to destroy the session. HttpServletRequest#isRequestedSessionIdValid() on the first tab will return true, but the session is no longer valid, and trying to read its attributes results in an error. Then, go again to http://localhost:8080/session-invalidation-1.0-SNAPSHOT/session-creation After that, go to http://localhost:8080/session-invalidation-1.0-SNAPSHOT/session-check-async That page invalidates the session from another thread (run from a ManagedExecutorService). It works as expected in that case.