Jonathas Carrijo Jonathas Carrijo - 5 months ago 34
Java Question

How to set session timeout dynamically in Java web applications?

I need to give my user a web interface to change the session timeout interval. So, different installations of the web application would be able to have different timeouts for their sessions, but their

web.xml
cannot be different.

Is there a way to set the session timeout programatically, so that I could use, say,
ServletContextListener.contextInitialized()
to read the configured interval and set it upon application startup?

Thanks a lot.

Answer

Instead of using a ServletContextListener, use a HttpSessionListener. In the sessionCreated() method, you can set the session timeout programmatically.

public class MyHttpSessionListener implements HttpSessionListener{
  public void sessionCreated(HttpSessionEvent event){
    event.getSession().setMaxInactiveInterval(15*60); //in seconds
  }
  public void sessionDestroyed(HttpSessionEvent event){}
}

And don't forget to define the listener in the deployment descriptor:

<webapp>
...
  <listeners>
    <listener-class>com.example.MyHttpSessionListener</listener-class>
  </listeners>
</webapp>

Still, I would recommend creating different web.xml files for each application and defining the session timeout there:

<webapp>
...
  <session-config>
    <session-timeout>15</session-timeout> <!-- in minutes -->
  </session-config>
</webapp>