Hi Saurabh,
Yes it is possible that a session is not invalicdated if the container is shutdown and then restarted. I have done this on
Tomcat, infact if memory serves correctly its the standard behaviour on tomcat.
For example create a servlet/jsp that saves something into the HttpSession. then another that displays what was saved in the HttpSession
Point your browser at the first one, wait till the page comes up, then shut the server down, and restart it. Then point your browser at the second page.
I have done this with tomcat and had what was save into the session displayed on the page. The simple reason is that Sessions are serialised to the file system and then reloaded from the filesystem on a new request. Tomcat does not clear its cache of session data when restarted so its still there.
HTH
Matt