A new session has no associated data. You must deal with situations involving new sessions. A user's session can be invalidated manually or, depending on where the servlet is running, automatically. To invalidate a session means to remove the HttpSession object and its values from the system. To manually invalidate a session, use the session's invalidate method.
Some applications have a natural point at which to invalidate the session.
The Duke's Bookstore example invalidates a user's session after the user has bought the books. By default, session tracking uses cookies to associate a session identifier with a user. To also support users that access a servlet with a browser that does not support cookies, or that is set up to reject cookies, you must use URL rewriting instead. When you use URL rewriting you call methods that, when necessary, include the session ID in a link. You must call these methods for every link in the servlet response.