用户登陆问题，session.invalidate销毁session

用户第一次登陆，可以登陆，点退出，调用session.invalidate，然后再次登陆，正常登陆，然后再点退出，这是第二次点退出第三次进行登陆，这时在登陆的时候就会报错了，java.lang.IllegalStateException: invalidate: Session already invalidated
全部异常为：

2007-12-24 15:56:00 org.apache.catalina.core.StandardWrapperValve invoke
严重: Servlet.service() for servlet action threw exception
[color=#FF0000]java.lang.IllegalStateException: invalidate: Session already invalidated[/color]
at org.apache.catalina.session.StandardSession.invalidate(StandardSession.java:1086)
at org.apache.catalina.session.StandardSessionFacade.invalidate(StandardSessionFacade.java:149)
at struts.form.SessionDestroy.setSession(SessionDestroy.java:34)
at struts.form.UserLoginForm.validate(UserLoginForm.java:41)
at org.apache.struts.action.RequestProcessor.processValidate(RequestProcessor.java:928)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:204)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1194)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:432)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:709)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at struts.form.FilterEncoding.doFilter(FilterEncoding.java:51)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:595)


这个原因我一开始还以为是超时了什么的呢，后来经测试才知道，是因为用了session.invalidate()，session.invalidate的销毁是把这个session所带的用户彻底的销毁，这个session跟用户已经紧密联合在一起，所以就一起销毁了，这样就算换了个session，也是登陆不了的，以前我的代码就是这样写的，下面：

((HttpSession) sc.getAttribute(userName)).invalidate();// 清除第一次登陆的session 

这样销毁的可是userName啊，所以要注意，销毁session的时候绝对不能用这种形式，可以用下面的销毁来控制用户没有登陆的话不可以浏览网页和后退也不能进行操作，把上边的代码改成下边的一句就搞定：

session.removeAttribute("sessionUserName");

移除用户，但session不变，下次登陆的时候看到的sessionID还是一样的