You invalidate the session. I would have to look up how to do it in JSP myself, but if your using a servlet, or a filter to accomplish the logout, then that is going to be Java code, and there it is
yourHttpSessionVariable.invalidate();
I hope your not starting every page with the equivalent of
HttpSession session = request.getSession();
// or
HttpSession session = request.getSession(true);
as those create a new session if no valid session already exists. That method should only be used on the initial login every other should use
HttpSession session = request.getSession(false);
this one will return null if there is no valid session.
The best place to do this is in a Filter, as there you can redirect the user to a login site (when no valid session exists), and once the user is logged in the Filter can then redirect back to the site the user originally wanted.