If you're using the declarative J2EE security, this last part should not
be possible (IIRC it isn't). The only problem that remains then, is to
keep the session valid until the user goes to another website.

However, a user may have two browsers or browser windows open at the same
time, and generally may go on the web where and when he pleases (given
authorization). So basically, this problem cannot be solved.

Your best bet is to let the session have a timeout of, say, a week (with
caching on disk). For the user, this will amount to the same thing, as:
- a user is unlikely to have a bworser open for more than a week; and
- the session cookie expires when the browser closes, what amounts to
 logging out.

Oscar