This question really belongs more in the
servlet list than the Struts list because it involves the standard API, rather than anything specific to Struts.
Here's a stab at an answer, however.
When a user logs out, you get his current HttpSession and call the invalidate() method on it.
If you want to check to see whether a user is currently logged on and has a session before letting her do anything, put the following code near the beginning of each action:
if you pass the false parameter to the getSession() method, it will not create a session if one does not exist. That's how you can tell if the user has one or not.
Merrill