HttpSession never removed from activeSessions

When an HttpSession is destroyed com.sun.faces.application.WebappLifecycleListener tries to remove it from its lists of activeSessions.

    public void sessionDestroyed(HttpSessionEvent event) {        

        if (activeSessions != null) {

            activeSessions.remove(event.getSession());

        }

The call to activeSessions.remove never actually removes a Session because a new instance of io.undertow.servlet.spec.HttpSessionImpl is used for the call and HttpSessionImpl does not implement an equals method. Thus Object.equals is used and the comparison fails.

This problem occures only if a session is invalidated due to a session timeout. A manual call to session.invalidate() works without any problem.

After some time this leads to an OutOfMemoryError.

A fix that works for us was to add this equals method:

    @Override

    public boolean equals(Object obj) {

    	if (obj instanceof HttpSessionImpl) {

    		return session.equals(((HttpSessionImpl)obj).session);

    	}

    	return false;

    }