Programmatically expire all sessions on Java web application restart -

i need way disable session persistence on tomcat restarts can bundled inside application.

so figured out best way programmatically.

the problem cannot find way of keeping collection of sessionids property of application scoped serializable bean , iterate on those, retrieving (recovering persistent storage , deserializing) session object corresponding each sessionid in order destroy it.

instead seems solution keep same collection whole session objects.

how can avoid , still able destroy session objects on application restart or whenever please in way independent of servlet container?

this i've ended doing:

i've kept indeed serializable application scoped bean serializable property: hashtable keys session ids , values timestamps of creation (i've used long instead of timestamp minimize memory footprint).

i using httpsessionlistener implementation populate hashtable , eliminate expired sessions on sessioncreated , sessiondestroyed methods.

the bean has @postconstruct method gets table , sets values 0.

and here's nasty part:

every time want use session object (for example, after request.getsession()) have "manually" invoke method checks if value on table 0 , if expire session , create new one.

there has better way it, or reason why shouldn't done. please let me know if know of one.