Recently there was an issue with the session not getting invalidated upon logging out in adf page. we were using the following code to invalidate the session in the logout method
FacesContext fc = FacesContext.getCurrentInstance(); ExternalContext ec = fc.getExternalContext(); HttpServletRequest req = (HttpServletRequest) ec.getRequest(); HttpServletResponse res = (HttpServletResponse) ec.getResponse(); HttpSession ses = (HttpSession) req.getSession(false); ses.invalidate(); res.sendRedirect(target); fc.responseComplete();
with the above code the following exception was thrown to the user
java.lang.NullPointerException at oracle.adf.share.http.HttpUtil.getAttribute(HttpUtil.java:98) at oracle.adf.share.http.HttpSessionScopeAdapter.get(HttpSessionScopeAdapter.java:240) at oracle.jbo.common.ampool.SessionCookieImpl.<init>(SessionCookieImpl.java:164) at oracle.jbo.http.HttpSessionCookieImpl.<init>(HttpSessionCookieImpl.java:133) at oracle.jbo.http.HttpSessionCookieImpl.<init>(HttpSessionCookieImpl.java:124) at oracle.jbo.http.HttpSessionCookieFactory.createSessionCookie(HttpSessionCookieFactory.java:131) at oracle.jbo.common.ampool.ApplicationPoolImpl.createSessionCookie(ApplicationPoolImpl.java:452) at oracle.adf.model.bc4j.DataControlFactoryImpl.findOrCreateSessionCookie(DataControlFactoryImpl.java:141) at oracle.adf.model.bc4j.DataControlFactoryImpl.createSession(DataControlFactoryImpl.java:222) at oracle.adf.model.binding.DCDataControlReference.getDataControl(DCDataControlReference.java:76) at oracle.adf.model.BindingContext.get(BindingContext.java:457) at oracle.adf.model.binding.DCUtil.findSpelObject(DCUtil.java:280) at oracle.adf.model.binding.DCUtil.findSpelObject(DCUtil.java:248) at oracle.adf.model.binding.DCUtil.findContextObject(DCUtil.java:383) at oracle.adf.model.binding.DCIteratorBinding.<init>(DCIteratorBinding.java:127) at oracle.jbo.uicli.binding.JUIteratorBinding.<init>(JUIteratorBinding.java:60)
the issue is solved using the solution given in this forum
https://cn.forums.oracle.com/forums/thread.jspa?threadID=663589
ie. we have to release the Datacontrol also to invalidate the session
...
ValueBinding vb = fc.getCurrentInstance().getApplication().createValueBinding("#{data}");
BindingContext bc = (BindingContext)vb.getValue(fc.getCurrentInstance());
DataControl dc = bc.findDataControl("DataControl");
dc.release(DataControl.REL_ALL_REFS);
..
They point the finger at me.. again! 
Nice post…
i too have a similar scenario
My code is:
public String doLogout() {
FacesContext ctx = FacesContext.getCurrentInstance();
ExternalContext eCtx = ctx.getExternalContext();
String url = eCtx.getRequestContextPath() + “/logoutservlet”;
try {
eCtx.redirect(url);
} catch (Exception e) {
e.printStackTrace();
}
ctx.responseComplete();
return “”;
}
Where should i release the Datacontrol also to invalidate the session?Kindly reply