Java Web Forms Without Session Ghost Bugs

Java Web Forms Without Session Ghost Bugs

“Ghost bug” reports in classic Java web apps often come from stale session values leaking across requests. Fixing this starts with strict request/session boundaries.

Step 1: Keep request DTO separate from session model

record LoginRequest(String email, String password) {}
record UserSession(String userId, String role) {}

Step 2: Create explicit session lifecycle hooks

void startSession(HttpSession s, UserSession u) {
    s.invalidate();
    HttpSession fresh = request.getSession(true);
    fresh.setAttribute("user", u);
}

Step 3: Clear scoped attributes on flow completion

request.removeAttribute("formErrors");

Pitfalls

• Reusing session attributes for transient form validation state.
• Never rotating session on login boundary.
• Assuming request and session cleanup are equivalent.

Validation

• Session fixation tests pass.
• Multi-tab flows no longer leak stale errors.
• Logout fully clears user and flow-scoped state.