Http session binding listeners are not called when session expires. The issue is in HttpSessionNotifier#sessionDestroyed method that is not checking if stored objects implement HttpSessionBindingListener - for each such object the notifier should call valueUnbound method.
Http session binding listeners are not called when session expires. The issue is in HttpSessionNotifier#sessionDestroyed method that is not checking if stored objects implement HttpSessionBindingListener - for each such object the notifier should call valueUnbound method.