I discovered that the reason my sessionDestroyed() handler is called twice is, for a change, not due to my rauceus
programming but because of the Tomcat version (5.0.16) I was using. The standard sessions manager expires timed out
sessions twice, once when checking whether they have expired and again when, well, is on the job. Of course I’m sure
you’re not using that old a Tomcat version but just in case. See bugzilla issues
25234 and
27273 for more info. There’s actually at least a couple
more duplicate issues there.