The majority of servlet containers recycle their request objects and return them to the pool for reuse. Since the requestedSession is stored in the wrapper level (not as an request attribute like currentSession), it won't be recycled.
We should improve this in a way that when the request is recycled, the requestedSession is also "cleared".
Thanks @swendlandt for the help identifying this improvement.
As of now, the
requestedSessionis cached as a field in the request wrapper.The majority of servlet containers recycle their request objects and return them to the pool for reuse. Since the
requestedSessionis stored in the wrapper level (not as an request attribute likecurrentSession), it won't be recycled. We should improve this in a way that when the request is recycled, therequestedSessionis also "cleared".Thanks @swendlandt for the help identifying this improvement.