please don't
crosspost. It makes it difficult to follow a conversation.
Why are you compiling user session objects? When a request enters a
servlet you can get the current session with HttpServletRequest.getSession() so I wouldn't think you'd need to compile a list of them. There is no notification when a session expires, either. You could have a reaper
thread iterate through the list every once in a while and check the HttpSession.getLastAccessedTime to see if it's longer than your session timeout, but first I'd question keeping the session objects around in the first place.