What is the default session timeout for a Java EE website?

Question

If I do not specify the following in my web.xml file:

<session-config>
    <session-timeout>600</session-timeout>
</session-config>

What will be my default session timeout? (I am running Tomcat 6.0)

Answer 1

I'm sure it depends on your container. Tomcat is 30 minutes.

Answer 2

If you're using Tomcat, it's 30 minutes. You can read more about it here.

Answer 3

You can also set this in code, for a specific session using the HttpSession setMaxInactiveInterval API:

Specifies the time, in seconds, between client requests before the servlet container will invalidate this session. A negative time indicates the session should never timeout.

I mention this in case you see timeouts that are not 30 minutes, but you didn't specify another value (e.g. another developer on the project used this API).

Another item to note is this timeout may not trigger on the exact second the session is eligible to expire. The Java EE server may have a polling thread that checks for expired sessions every minute. I don't have a reference for this, but have seen this behavior in the WebSphere 5.1 era.

Answer 4

Session Time out we can specify for that particular context in web.xml file as mentined below entry 60

Default Session time out is 30 mins