Session Management could be implemented in several
ways. As I know, tomcat  relay on COOKIE(s) to managing
sessions. Mostly, the problem  you mentioned is because
of browser settings. New browsers  have some mechanisms
to block cookies from unsafe web sites or block them
at all. Probably, your browser is doing something like
that.

So, just take a look at your browser settings.

Example String username=request.getParameter("username");
you can create session  with session.setAttribute("username",username);
in the welcome page, you can use if (session.getAttribute("username",null){ RequestDispatcher.getRequestDispatcher("login.jsp").forward(request,response); }
to remove session, session.removeAttribute("username");