5.10. Controlling Session Timeouts

If a session has not been accessed for a certain period of time, the server can throw it away to save memory. You can explicitly set the timeout for individual session objects by using the setMaxInactiveInterval method of HttpSession. If you do not use this method, the default timeout is server specific. However, the session-config and session-timeout elements can be used to give an explicit timeout that will apply on all servers. The units are minutes, so the following example sets the default session timeout to three hours (180 minutes).

<session-config> 
  <session-timeout>180</session-timeout> 
</session-config>