Tomcat Session Timeout web.xml

Question

This is my web.xml file, it is located in WEB-INF/lib. It specifies session timeout at 1 minute, however it does not time the user out after 1 minute of activit

Answer 1

1. One minute is a ridiculously low session timeout. It should be several hours.

2. The timeout happens after that much inactivity, not that much activity.

3. The correct test is request.getSession(false) == null, or request.getSession(true).isNew().