为何关闭TOMCAT后SESSION还有效啊？

页面里我通过判断取得的Authorization是否为空，如果为空则重新登录；现在问题是我关闭TOMCAT后再重启，取得的Authorization对象都不为空，也就是说SESSION还有效，试过许多次了，不知道是何原因，不知各位有碰见相同的情况？又该如何解决？

这是登录类：

public class SkinUtil {
	
	public static Authorization login(HttpServletRequest request, HttpServletResponse response, String userName, String pwd);{
		
		MemberManager mManager = new MemberManager();;
		Member member = mManager.getMember(userName,pwd);;
		Authorization auth = null;
		if (member != null);{
			auth = new Authorization(member.getId();,member.getMembername(););;
			HttpSession session = request.getSession();;
			session.setAttribute("Member_Auth",auth);;
		}
		return auth;
	}
	
	public static Authorization getAuth(HttpServletRequest request,
										HttpServletResponse response);{
		
		HttpSession session = request.getSession(false);;
		
		Authorization auth = (Authorization);session.getAttribute("Member_Auth");;
		if (auth != null);{
			return auth;
		}else{
			return null;
		}
	}
	
	public static boolean isUserExist(String userName);{
		MemberManager mManager = new MemberManager();;
		Member member = mManager.getMember(userName);;
		if (member == null);{
			return false;
		}else{
			return true;
		}
	}
	
	public static void logout(HttpServletRequest request,
							  HttpServletResponse response);{
		HttpSession session = request.getSession();;
		session.removeAttribute("Member_Auth");;				  	
	}
}

下面是JSP页面：

	Authorization auth = (Authorization);session.getAttribute("Member_Auth");;
        if (auth == null);{
		out.println("<script> top.location.href=\"login.jsp\"; </script>");;
		return;
	}

看错了，
session应该是失效的。
你需要在具体的描述一下，比如你的取权限的jsp是什么从跳转哪里来的

我没有写COOKIE啊，代码里你也看见了；如果我将SESSION。SETATTRIBUTE（“MEMBER_AUTH”，AUTH）；这段代码写入JSP页面里，结果也是一样的。

我也碰到这个问题了，我用的是tapestry,把用户信息保存在Visit对象中，结果tomcat关闭而不关闭当前打开的ie,用户信息依然有效，后来我又写到session中
效果还是一样.关注...

tomcat/resin/jetty等大部分的servlet container都会把session序列化到硬盘, 重起以后, 客户端的session id没有改变, 还能重新取得.

那要如何设置啊？

偶没有用过tomcat, 查文档, 或者去mail list问, 或者召唤tomcat达人......

把tomcat下的work目录删除试一下看看.

仔细看了下tomcat的server.xml

To clear sessions from the Store, set maxActiveSessions, maxIdleSwap,
               and minIdleBackup all to -1, saveOnRestart to false, then restart
               Catalina.

<Manager className="org.apache.catalina.session.PersistentManager"
              debug="0"
              saveOnRestart="false"
              maxActiveSessions="-1"
              minIdleSwap="-1"
              maxIdleSwap="-1"
              maxIdleBackup="-1">
                <Store className="org.apache.catalina.session.FileStore"/>
</Manager>

    HttpSession session = null ;
    session = request.getSession();;
    boolean isNew = session.isNew();;
    if (!isNew);{
      session.removeAttribute("Author什么的，我没写全");;
      session = request.getSession(true);;
    }
    session.setMaxInactiveInterval(3600*12);;

在serlvet里加上这么一段试试