"A. Schirmacher" <nn4l at yahoo.de> writes: if (logout != null) { session.invalidate(); } if (form_login != null) { String user = cmsObject.loginUser(form_username, form_password); session = cmsObject.getRequestContext().getSession(true); %> This means: get a session when logging in and invalidate when logging out.