Currently, HttpServletRequest.getSession(...) will return an invalid session if a concurrent request has invalidated the session. According to the servlet spec, this method should return null (or a new session) if the session currently associated with the request was invalidated.