after user  logged out from the system, you have to invalidate the user's session. as you know each user has his/her own session, then invalidating a session  does not  affect others session.
if you are using JSF you have to write  line of code in your backing bean as follow:

((HttpSession) FacesContext.getCurrentInstance().getExternalContent().getSession(true)).invalidate();

if you are using Struts or Common Java Servlet you can do it by Code as follow on your action/doget/dopost method:
httpServletRequest().getSession().invalidate();

i hope this email can solve your problem