java - is removing user credentials from session in addition to invalidate() superfluous? -

i looking @ legacy code base (at least ten years old) featuring amounts jsp model 2 architecture (basically servlets , jsp pages).

i noticing code following:

session.removeattribute("loginbean"); session.invalidate(); 

is there benefit in removing user credentials session. shouldn't invalidate alone sufficient? invalidate documentation seems pretty clear on subject.

is there benefit in removing user credentials session. shouldn't invalidate alone sufficient ?

yes, there benefit , best practice remove sensitive information usercredentials object before invalidating httpsession security perspective explained below:

when call invalidate() on httpsession object, j2ee container internally triggers httpsessionlistener sessiondestroyed(httpsessionevent se) method. so, if don't remove usercreadentials object session, can still able retrieve inside sessiondestroyed method.

so, point is best practice remove sensitive information httpsession/cache/etc.. know data no longer required object (like usercredentials) no more reachable, reduce scope misuse.

you can @ guideline 2-2 below quote java secure coding guide:

some information, such social security numbers (ssns) , passwords, highly sensitive. information should not kept longer necessary nor may seen, administrators.

you can @ here