Atmosphere/atmosphere — pull request #1139 by dretzlaff (2013-06-12 04:03:44+00:00)
Title: don't return invalid session from AtmosphereRequest#getSession

Issue #1074 reported a problem with session replacement within a single request. Session replacement is a common pattern to discourage session fixation attacks. A fix was committed introducing SessionSupport which clears the HTTP session from registered resources when the session is destroyed. However, this does not clear the session from the resource in the AtmosphereRequest's attribute map. So calls to HttpServletRequest#getSession() still return this invalid session.

This pull request includes a unit test demonstrating the issue. It's also apparent from this simple Filter. When served through Atmosphere, the second request results in an IllegalStateException.

```java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException {
HttpServletRequest httpRequest = (HttpServletRequest) request;

if (httpRequest.getSession(true).isNew()) {
response.getOutputStream().write("session created".getBytes());
}
else {
try {
httpRequest.getSession().invalidate();
httpRequest.getSession(true).getAttribute("test");
}
catch (RuntimeException e) {
e.printStackTrace();
throw e;
}
}
}
```

I am new to Atmosphere so maybe there is a more direct way to access and reset this resource's session. This pull request simply introduces a validity check in AtmosphereRequest#getSession().