Thanks for the replay, per my testing it indicated the user still was able to revisit the GWT based application even the session == null && the principal == null. So my question is: Can JBoss container enforce the login after the logout in the GWT based app? if is not, how to enforce the login in GWT are there any practical approach? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4108265#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...