Recently there was an issue with the session not getting invalidated upon logging out in adf page. we were using the following code to invalidate the session in the logout method

FacesContext fc = FacesContext.getCurrentInstance();
ExternalContext ec = fc.getExternalContext();
HttpServletRequest req = (HttpServletRequest) ec.getRequest();
HttpServletResponse res = (HttpServletResponse) ec.getResponse();
HttpSession ses = (HttpSession) req.getSession(false);
ses.invalidate();
res.sendRedirect(target);
fc.responseComplete();

with the above code the following exception was thrown to the user

java.lang.NullPointerException
 at oracle.adf.share.http.HttpUtil.getAttribute(HttpUtil.java:98)
 at oracle.adf.share.http.HttpSessionScopeAdapter.get(HttpSessionScopeAdapter.java:240)
 at oracle.jbo.common.ampool.SessionCookieImpl.<init>(SessionCookieImpl.java:164)
 at oracle.jbo.http.HttpSessionCookieImpl.<init>(HttpSessionCookieImpl.java:133)
 at oracle.jbo.http.HttpSessionCookieImpl.<init>(HttpSessionCookieImpl.java:124)
 at oracle.jbo.http.HttpSessionCookieFactory.createSessionCookie(HttpSessionCookieFactory.java:131)
 at oracle.jbo.common.ampool.ApplicationPoolImpl.createSessionCookie(ApplicationPoolImpl.java:452)
 at oracle.adf.model.bc4j.DataControlFactoryImpl.findOrCreateSessionCookie(DataControlFactoryImpl.java:141)
 at oracle.adf.model.bc4j.DataControlFactoryImpl.createSession(DataControlFactoryImpl.java:222)
 at oracle.adf.model.binding.DCDataControlReference.getDataControl(DCDataControlReference.java:76)
 at oracle.adf.model.BindingContext.get(BindingContext.java:457)
 at oracle.adf.model.binding.DCUtil.findSpelObject(DCUtil.java:280)
 at oracle.adf.model.binding.DCUtil.findSpelObject(DCUtil.java:248)
 at oracle.adf.model.binding.DCUtil.findContextObject(DCUtil.java:383)
 at oracle.adf.model.binding.DCIteratorBinding.<init>(DCIteratorBinding.java:127)
 at oracle.jbo.uicli.binding.JUIteratorBinding.<init>(JUIteratorBinding.java:60)

the issue is solved using the solution given in this forum
https://cn.forums.oracle.com/forums/thread.jspa?threadID=663589

ie. we have to release the Datacontrol also to invalidate the session

...
ValueBinding vb = fc.getCurrentInstance().getApplication().createValueBinding("#{data}");
BindingContext bc = (BindingContext)vb.getValue(fc.getCurrentInstance());
DataControl dc = bc.findDataControl("DataControl");
dc.release(DataControl.REL_ALL_REFS);
..