Tomcat 3.2.4 and Session validation

[Daniel Vieira Viveiros]

Hi,

    I'm using Tomcat 3.2.4 as the JSP engine of my application and I've found this bug:

    When the user logs in the app, I have to invalidate the session and create a new 
one. I'm using the following code:

    HttpSession session = request.getSession( false );
    if ( session != null ) {
        session.invalidate();
    }
    session = request.getSession( true );

    The problem is that the new session is created already invalid. I've looked the 
history of this mailing list and I think this is a well-known bug. Someone told that 
there is a patch for this bug but I could not find it. Can anyone help me find this 
patch or send it to me?
    There is another point I want to ask you all. Is it worthy update the JSP Engine 
to TomCat 3.3 (or 4.0)? Do the benefits justify the risk of a plataform migration? Is 
there any compatibility problem?

Thanks,
Daniel Viveiros