JEENoob JEENoob - 3 months ago 56
Java Question

Session timeout confusion - session.setMaxInactiveInterval(0)

I am new to JEE and this is what confuses me. According to HttpSession.html#setMaxInactiveInterval(int interval) documentation


An
interval
value of
zero
or less indicates that the session should never timeout.


but according to my text book (which already is few years old - so I expect it not to be always right) using zero as argument should cause session to timeout immediately.

This code

public class Test extends HttpServlet {

protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {

response.setContentType("text/html");
response.setCharacterEncoding("utf-8");

PrintWriter out = response.getWriter();

HttpSession session = request.getSession();
session.setAttribute("foo", 42);
session.setMaxInactiveInterval(0);

out.println(session.getAttribute("foo"));//problem here

}
}


used on Glassfish 4.0 seems to confirm theory from textbook instead of newer official documentation because it returns HTTP Status 500 - Internal Server Error with error message


java.lang.IllegalStateException: getAttribute: Session already invalidated



What is going on here? Is this Glassfish 4.0 bug or documentation is wrong? Or maybe there is third option?




PS. This code works as it should with negative values (session is not invalidated) and I am using
-1
instead of
0
in my code. I am just interested what is wrong with
0
.

Answer

The Servlet Specification chapter on Session Timeouts states

By definition, if the time out period for a session is set to -1, the session will never expire.

So GlasshFish seems to have that covered. I can't find any reference in the specification that says that the same should be true for a value of 0 with setMaxInactiveInterval(). However it does say

The session-config defines the session parameters for this Web application. The sub-element session-timeout defines the default session time out interval for all sessions created in this Web application. The specified time out must be expressed in a whole number of minutes. If the time out is 0 or less, the container ensures the default behavior of sessions is never to time out. If this element is not specified, the container must set its default time out period.