Thanks for your reply Vanessa and Bill, We finally found the root cause of this issue, it is because the user does a double click on a link within a nano seconds(duplicate click), so the application receieves couple of requests, where the first request ends up with the exception due to the business requirement and it invalidates the session, and the second request(which is nothing but a duplicate submit by the user) is trying to access the same session which was invalidated, thats the reason for this exception. I am posting this because it might be useful for someone else,, thank you..