title: HttpSessionListener.sessionDestroyed() method is getting called twice during Session timeout
body: <p>I am trying to log a message whenever HTTP Session is destroyed.
  I am using <strong>Spring Boot, Spring Security and Tomcat 8</strong> (embedded) in this web application.</p>
  
  <p>During session timeout, <strong>sessionDestroyed() method is getting called 2 times</strong>, so my message is logged twice.</p>
  
  <p>I checked the session ID and <strong>session id is SAME</strong> during both invocations.</p>
  
  <p>This is how my code looks like...</p>
  
  <pre><code>import org.springframework.security.core.session.SessionRegistry;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>        @Component
          public class MySessionListener implements javax.servlet.http.HttpSessionListener, ApplicationContextAware {
              @Autowired(required = false)
              SessionRegistry sessionRegistry;
  </code></pre>
  
  <p>and sessionDestroyed() is below.</p>
  
  <pre><code>@Override
      public void sessionDestroyed(HttpSessionEvent se) {
          HttpSession session = se.getSession();
  
          SecurityContextImpl springSecurityContext = (SecurityContextImpl)session.getAttribute("SPRING_SECURITY_CONTEXT");
          if(springSecurityContext!=null){
              Authentication authentication = springSecurityContext.getAuthentication();
              LdapUserDetails userDetails = (LdapUserDetailsImpl)authentication.getPrincipal();
  
              WebAuthenticationDetails WebAuthenticationDetails = (WebAuthenticationDetails)authentication.getDetails();
              String userIp = WebAuthenticationDetails.getRemoteAddress();
  
              Log.info(userDetails.getUsername(),userIp,timestamp,"timeout or logout","session destroyed");
  
          }
  
         sessionRegistry.removeSessionInformation(se.getSession().getId());
          logger.info("Due to timeout/logout Session is Destroyed : Session ID is..." + session.getId());
  
      }
  </code></pre>
  
  <p>Any help will be appreciated...</p>
  
  <p><strong>Note:</strong> I noticed this issue was a defect in <strong>Tomcat 5</strong>, I don't think that defect is still unfixed in Tomcat 8.</p>
  
  <p>Reference: <a href="https://bz.apache.org/bugzilla/show_bug.cgi?id=25600" rel="nofollow">https://bz.apache.org/bugzilla/show_bug.cgi?id=25600</a></p>