Happens with standard 1.0.3 taglib. The bug arises for example on "Disconnected" pages if you want to display the message in the user's locale. If you want to use "fmt" tags with an invalidated session, when Config.find() tries to lookup for the formatting locale in the session you'll get the servlet container throws an java.lang.IllegalStateException about "getAttribute" being used on invalidated session. Here is a sample JSP showing the issue: <%@ taglib prefix="c" uri="http://java.sun.com/jstl/core" %> <%@ taglib prefix="fmt" uri="http://java.sun.com/jstl/fmt" %> <!-- Invalidate the session. --> <% session.invalidate(); %> <html> <head> <title>Test case for invalidated sessions</title> </head> <body> <!-- Lookup occurs here to find the formatting locale. -- Currently lookup is also done through the session -- even if it has been invalidated, -- causing an exception to be thrown --> <jsp:useBean id="now" class="java.util.Date" /> <fmt:formatDate value="${now}" type="both"/> </body> </html> Here are the last lines of stack trace on Tomcat 4.1.24: java.lang.IllegalStateException: "getAttribute": Session already invalidated at org.apache.catalina.session.StandardSession.getAttribute(StandardSession.java:954) at org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:171) at org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:171) at org.apache.jasper.runtime.PageContextImpl.getAttribute(PageContextImpl.java:222) at javax.servlet.jsp.jstl.core.Config.get(Config.java:145) at javax.servlet.jsp.jstl.core.Config.find(Config.java:393) at org.apache.taglibs.standard.tag.common.fmt.BundleSupport.getLocalizationContext(BundleSupport.java:161) at org.apache.taglibs.standard.tag.common.fmt.SetLocaleSupport.getFormattingLocale(SetLocaleSupport.java:283) at org.apache.taglibs.standard.tag.common.fmt.FormatDateSupport.doEndTag(FormatDateSupport.java:148) As there is no method to see if a session is invalidated (at least with servlets 2.3), a possible solution could be to catch IllegalStateException in this case. Although this case is not described in the specs (I only saw things about pages without session in section 2.2.1), it would seem better compliant with general error handling behaviour in JSTL (section 2.7).
Agree. Fixed.