This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
When session is timed out, then it is eligible for invalidate. At this time the session will not be invalidated. If the application implements HttpSessionListener, it notifies that the session is about to invalidated via. sessionDestroyed() method. If we want to cleanup any resources, that should be placed there. After everything is done, then the session will be invalidated.