session.invalidate(); will do the job.....we should have conditions to check if the session-attributes are present in every page except the login page....


or session.removeAttribute(); will also...