I found that $session in delete_existing_session() doesn't get the existing session in spite of providing the proper session_id to the sub, which means that $session->delete() doesn't do anything.

...
# Load existing session     
$session = CGI::Session->load( $exist_sess_id );

$session->delete();

...
...
[download]

So, when the control returns back to get_session(), it recognizes the id that was passed in and retrieves the old one..

I am wondering what makes $session = CGI::Session->load( $exist_sess_id ); to fail to retrieve the session.

Any tips would be of great help. Thanks

I still don't know why CGI::Session->load(..) is not fetching the valid session but I modified login.cgi and delete_existing_session() as follows and it is working now..

--------------------------------------------
login.cgi - final
--------------------------------------------

#!/usr/bin/perl -w

...
...

# new query object
my $cgi = CGI->new;

# get existing id from cookie 
my $existing_id = $cgi->cookie('CGISESSID') or undef;

# If existing_id is valid, then call sub to delete the session
if ( defined $existing_id) {

 # Load and Delete existing session
 delete_existing_session($existing_id);

}
# Get a new session
my $session = get_session($cgi);

...
...


--------------------------------------------
delete_existing_session() - final 
--------------------------------------------

sub delete_existing_session {

 my $exist_sess_id = shift;

 # Load existing session     
 my $session = CGI::Session->new( undef, 
                                $exist_sess_id, 
                { Directory => '/usr/sessions' })         
        or die "can't create session: $!";

 # Delete the session    
 $session->delete();
 $session->flush();
    
}
[download]

Thanks for the inputs, vgn