Getting the time in seconds in which the session will expire

Question

I am building a web application that has a top thin frame which should show the time in seconds in which the servlet session will timeout.

The problem is that a AJAX call to a servlet which returns the last access time, and the inactiveInterval itself updates the session.

So is there a way I can get information about the session via a servlet that does not incrementing the lastAccessedTime?

Thanks

Answer 1

In thesis, you should not relay the session expiry time on the session time itself, in your case a counter should be implemented by decreasing the login time from the current time.

   RemainingTime = CurrentTime - LoginTime

Your ajax call should query this variable. Hope that solves your problem.

Answer 2

Can I ask for some more details?

What is the real requirement? Is it that the session time out within x seconds of a user logging in?

In that case, you you can use the getCreationTime() method on the HTTPSession object

http://java.sun.com/javaee/5/docs/api/javax/servlet/http/HttpSession.html#getCreationTime%28%29

remainingTimeInMilliseconds = System.currentTimeMillis - session.getCreationTime()

OR

Is the requirement for the session to time out after x seconds of inactivity? If so then do a

remainingTimeInMilliseconds = System.currentTimeMillis - session.getLastAccessedTime()

Answer 3

There's no need for your top frame to ask the server for the last access time. Why not let every HTML page contain a JavaScript snippet, which sets a defined variable to either last access, or perhaps more convenient, set the variable to the assumed expiration date of the HTTP session. Depending on how you generate your web pages, you can add the code snippet to a default template, or perhaps even add a Filter, which will embed the required code on every HTML page.

Be aware though, that IMHO, the servlet specification only states, that the server may invalidate the session at some point after the expiration time has passed, so accessing the session after the expiration time is not guaranteed to fail.

Answer 4

It seems that no one really answered the question as asked. The last response is closest - and probably best - piggy back the information needed on another request. I would add that if you can count on XHR activity that you can set a response header with the value(s) you want.

Assuming you really want want you asked for - to summarize / restate - a servlet that participates in the session but doesn't update the last accessed time, you should be able to accomplish that with a Filter that chains an overriden HttpServletResponse that returns an overridden Session object - overriding the getLastAccessedTime() method with its own (stored as an attribute in the real session of course). It will probably need to perform its own manual invalidation of the real session.

Questions like this show the age of the Servlet specification, even in its latest forms, there isn't enough control of some of the low-level authentication mechanisms, and overriding can be difficult even with Filters. These limitations manifest themselves using technologies like AJAX.