Tomcat 4 and 5 do swap session objects to secondary storage such as a database. You can configure Tomcat to do so. Internally, Tomcat employs a background
thread that checks how old a session object is, whether a session needs to be invalidated, etc. The module that manages session objects is called Manager (discussed in Chapter 9: Session Management).