Session Invalidate not Working with LTPA-based Security
问题 I normally handle site logout with a JSP that executes <%= session.invalidate() %> then redirects to the home page. Now I am running on WebSphere authenticating using LTPA and a SSL Certificate. Session.invalidate() does not work. Someone suggested it is because WAS is using LTPA. LTPA creates an authentication cookie (LtpaToken2) that is not cleared by session.invalidate. IBM does have a proprietary logout JSP*** I could use, but I don't want to use a vendor specific solution. Has anybody