Direct the session to invalidate itself automatically after being inactive for a defined time period. Alternatively, invalidate the session manually with the HttpSession method invalidate().
To invalidate a session manually, simply call the following method:
session.invalidate();
All objects bound to the session are removed.
Session timeout is set using the session-timeout element in the web.xml deployment descriptor file. For more information, see the Java Servlet 2.3 specification.