Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated error

Written By

Thanga Meena

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • Why does this error gets triggered? What would be the cause?
INFO  [http-nio-8080-exec-2573][CustomLoginPortlet:726] url redirect = https://xxxx/group/yyyy
ERROR [http-nio-8080-exec-2573][PortletServlet:112] javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated
javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated
        at com.liferay.portal.kernel.portlet.LiferayPortlet.callActionMethod(LiferayPortlet.java:205)
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.callActionMethod(MVCPortlet.java:415)
        at com.liferay.portal.kernel.portlet.LiferayPortlet.processAction(LiferayPortlet.java:97)
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.processAction(MVCPortlet.java:260)
        at com.liferay.portlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:77)
        at com.liferay.portal.kernel.portlet.PortletFilterUtil.doFilter(PortletFilterUtil.java:50)
        at com.liferay.portal.kernel.servlet.PortletServlet.service(PortletServlet.java:108)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)

Environment

  • Liferay DXP 7.1

Resolution

  • It shows that the session has already been invalidated. The stack trace occurs regarding the invalid session usually referring that there may be some code that invalidates the HttpSession. The session was being used in part of a call - however, some code was able to access and invalidate the HttpSession causing it to fail.
  • By default, the generated JSESSIONID can change whenever a user logs in to the Liferay platform, because, as a security measure, the platform attempts to invalidate the previous session. In Liferay platforms, by default the session.enable.phishing.protection portal property is enabled which has the valuetrue.
  • Another possible reason is described in this article. Please go through it for more information

Additional Information

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?