I have never worked with WebLogic, but from JavaDoc here I can say that calling getPortletSession() already a wrong idea if you want to invalidate an existing session because in JavaDocs it says:
Returns the current portlet session or, if there is no current session, creates one and returns the new session.
Thus, it creates a new session, and this is not what you need if you just want to cancel an existing session.
You need the getPortletSession(boolean create) method, you need to pass false when called, and it can return null if there is no session in the call method, so you will also need to handle null:
PortletSession current = request.getPortletSession(); if (current != null) try { current.invalidate(); } catch (IllegalStateException ignored) { // ok: session is already invalidated }
We need to catch this exception because from what I see in JavaDocs , there is no way to determine if the session was already invalid or not. Thus, we just invalidate anyway and ignore IllegalStateException if it is thrown due to a session that is already invalidated.
Also remember to call response.sendRedirect(exitURL); before canceling the session, my intuition tells me that this should be done before.