A user gets IllegalStateException if the method HttpSession.invalidate() is invoked inside an intercepted method (see the forum reference). This is likely caused by the fact that RequestScopedCache.endRequest() is also called during HttpContextLifecycle.sessionDestroyed(HttpSession) and so the current stack is removed before the invocation finishes.