参考原因:在Session里面放置了com.abc.UserBean对象,这个类也没有实现java.io.Serializable。
User authentication information is stored both in the users's session data and in the context of a server or virtual host that is targeted by a Web Application. Using the session.invalidate() method, which is often used to log out a user, only invalidates the current session for a user—the user's authentication information still remains valid and is stored in the context of the server or virtual host. If the server or virtual host is hosting only one Web Application, the session.invalidate()method, in effect, logs out the user.