[Peter]

use HttpSessionListener and use its life cycle event to detect the session invalidation.

Use following to make sure that the session is invalid and forward or redirect to an error.jsp page.

Code:

HttpServletRequest.getRequestedSessionId() 

HttpServletRequest.isRequestedSessionIdValid().