Should we reset the session variables to null on web application logout?

Question

Httpsession is per browser.Ideally should we reset the session variables on logout otherwise it will always be available for that Browser even user login again.Is that correct?

Answer 1

You don't need to reset all session variables. You just need to call session.invalidate() and servlet framework will take care of the rest.

Answer 2

You can just invalidate the session by calling HttpSession.invalidate() which will clear all the attributes as well as destroy the session itself.