In DistributableSession the validate method is getting called for any underlying undertow session access to make sure we are not touching an already invalidated session (which totally make sense):

public class DistributableSession implements io.undertow.server.session.Session {

    private static void validate(Session<LocalSessionContext> session) {
        if (!session.isValid()) {
            throw UndertowMessages.MESSAGES.sessionNotFound(session.getId());
        }
    }
}

The problem though is the exception message that is thrown is really misleading because in reality the session actually exists but is currently invalid and/or getting invalidated. This can happen especially when running in optimistic mode where we can have many differents threads accessing the very same session.

I would recommend we do instead:

        if (!session.isValid()) {
            throw UndertowMessages.MESSAGES.sessionAlreadyInvalidated();
        }

or even better:

        if (!session.isValid()) {
            throw UndertowMessages.MESSAGES.sessionAlreadyInvalidated(session.getId());
        }

but it will require also a change in Undertow to actually template/parametize the sessionAlreadyInvalidated message.

Thanks,