title: Java : HttpSession timeout filter check returns valid session object
body: <p>My Web App is purely JS app with crossroads js for routing.
  For Login I'm using j_security_check FORM Auth and /LogOut servlet to invalidate session.</p>
  
  <p><strong>Issue 1</strong>
  The real issue comes when the session is timed out, the login.html is rendered in part of the page with no css, with error 'Resource interpreted as Stylesheet but transferred with MIME type text/html'</p>
  
  <p>When using filter </p>
  
  <pre><code>&lt;filter&gt;
      &lt;description&gt;Session Timeout Filter&lt;/description&gt;
      &lt;filter-name&gt;SessionTimeoutFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;filters.SessionTimeoutFilter&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;SessionTimeoutFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  ....
  &lt;session-config&gt;
      &lt;session-timeout&gt;1&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>and JAVA code</p>
  
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response,
          FilterChain chain)
          throws IOException, ServletException {
  
      HttpServletRequest req = null;
      HttpSession session = null;
      try {
          req = (HttpServletRequest) request;
          session = req.getSession(false);
          if (session != null &amp;&amp; !session.isNew()){
              LOGGER.log("Session is Valid");
              chain.doFilter(request, response);
          }else{
              LOGGER.log("Session is Invalid");
              req.getRequestDispatcher("/login.html?loggedOut=true").forward(request, response);
          }            
      } catch (Throwable t) {
  
      }
  
  }
  </code></pre>
  
  <p><strong>Issue 2</strong>
  When the filter runs after say inactive 2-3 mins, it prints "Session is Valid". Why is it so?</p>