Session timeout in Java EE

jakarta-eeservletssession-timeoutweblogic

In which ways the time for session timeout can be defined in Java EE? I am looking beyond obvious ways, such as setting session timeout in web.xml or HttpSession.setMaxInactiveInterval().

I am currently reviewing a Java EE application, but I can't find anything related to session timeout definition. The web app is in Weblogic. I am assuming that since there is no session timeout definition, the session will never expire.

Best Answer

As you're looking for how the session can be timed out in Weblogic, I can add

TimeoutSecs in weblogic.xml or check for any point in the code where session is killed by session.invalidate() on logout.

By the way, it will not be infinite.

On Weblogic, the default in web.xml (if no value specified) is to use the TimeoutSecs value in weblogic.xml, which defaults to 3600 secs i.e. 60 mins

Related Solutions

JBoss Session Timeout

JBoss 5 allows you to define a session timeout for all applications at:

deployers/jbossweb.deployer/web.xml

It may be that is overriding your settings in web.xml. It shouldn't, but, you know...

Check if changing that is working. If not, you can set up the timeout programatically for your test:

HttpSession.setMaxInactiveInterval(int seconds)

That way you can force the timeout in a particular session.

Apache vs Weblogic session times

KeepAlive is not linked to session timeouts on weblogic.

The KeepAlive in the apache server is for improved performance by using a reusable pool of connections from the Apache plug-in to the WebLogic Server. If the connection is inactive for more than 30 seconds, (or a user-defined amount of time) the connection is closed and returned to the pool.

Still it is recommended to set KeepAlive ON and set the KeepAliveSecs 15 as default.

Now on to your main problem of enabling a 2 hour session timeout. Note: 2 hours is a high amount (the default is only 30 mins) and your Weblogic servers will be using up more memory keeping the session details alive.

I assume you are relying on Apache to direct to the correct Weblogic server based on the user's JSESSIONID. In that case - Apache will send the request to the correct Weblogic server in your cluster - and the user's session will stay alive on that server. Unless you switch on session replication which is another memory hogger.

But to answer your question, your 120 minutes should be respected based on the <session-timeout> setting in web.xml It is also possible to set this in weblogic.xml, but the overriding one is web.xml

Best Answer

Related Solutions

JBoss Session Timeout

Apache vs Weblogic session times

Related Topic