is there a way that tomcat 7 invalidates all sessions of an application when it is reloaded manually via the management interface?
All the best, Thomas
From the Tomcat doc:
Persistence Across Restarts
Whenever Apache Tomcat is shut down normally and restarted, or when an application reload is triggered, the standard Manager implementation will attempt to serialize all currently active sessions to a disk file located via the pathname attribute. All such saved sessions will then be deserialized and activated (assuming they have not expired in the mean time) when the application reload is completed.
In order to successfully restore the state of session attributes, all such attributes MUST implement the java.io.Serializable interface. You MAY cause the Manager to enforce this restriction by including the element in your web application deployment descriptor (/WEB-INF/web.xml).
Disable Session Persistence
As documented above, every web application by default has standard manager implementation configured, and it performs session persistence across restarts. To disable this persistence feature, create a Context configuration file for your web application and add the following element there:
<Manager pathname="" />
http://tomcat.apache.org/tomcat-7.0-doc/config/manager.html#Persistence_Across_Restarts
If you don't already have a META-INF/context.xml file, you could use this one:
<Context>
<Manager pathname="" />
</Context>
See Standard Manager Implementation , you should set pathName to an empty string or delete SESSIONS.ser before booting.