My portlet has private-session-attributes set to false. When I invalidate the session and ask the httpServletRequest for new one I'm receiving still the original session which was invalidated.
Steps to reproduce:
1. create portlet and in liferay-portlet.xml set private-session-attributes element to false
2. run following code from your portlet:
The problem is in SharedSessionServletRequest - it holds reference to session created in constructor. And doesn't create new one if when to original session has been invalidated.