[ Team LiB ] Previous Section Next Section

Recipe 11.3 Setting the Session Timeout Programmatically


You want to set a session timeout in your servlet code.


Use the HttpServletRequest object's getSession( ) method to get a reference to the HttpSession object. Then change the timeout period programmatically by using the HttpSession.setMaxInactiveInterval(int seconds) method.


The HttpSession.setMaxInactiveInterval(int seconds) method sets the timeout for a session individually, so that only the particular session object being operated upon is affected. Other servlets that do session tracking in the web application still use the session-timeout value in web.xml or, in the absence of this element, the server's default session-timeout value. Example 11-5 checks the timeout period for a session, then resets that timeout period to 20 minutes.

Example 11-5. Resetting a default timeout period
package com.jspservletcookbook;           

import java.util.Date;
import java.text.DateFormat;

import javax.servlet.*;
import javax.servlet.http.*;

public class SimpleSession extends HttpServlet {
 public void doGet(HttpServletRequest request, 
   HttpServletResponse response)
    throws ServletException, java.io.IOException {
        java.io.PrintWriter out = response.getWriter( );

        HttpSession session = request.getSession( );
        out.println("<title>Simple Session Tracker</title>");
        out.println("<h2>Session Info</h2>");

        out.println("session ID: " + session.getId( ) + "<br><br>");

        out.println( "The SESSION TIMEOUT period is " + 
            session.getMaxInactiveInterval( ) + " seconds.<br><br>");

        out.println( "Now changing it to 20 minutes.<br><br>");

        session.setMaxInactiveInterval(20 * 60);

        out.println("The SESSION TIMEOUT period is now " + 
            session.getMaxInactiveInterval( )  + " seconds.");

Figure 11-2 shows the result of requesting this servlet in a web browser.

Figure 11-2. Getting session-timeout info

This servlet gets the HttpSession object with the HttpServletRequest class's getSession( ) method.

Whatever the servlet's default timeout period is, say, 30 minutes, Example 11-5 changes the accessed session's timeout to 20 minutes:

session.setMaxInactiveInterval(20 * 60);

Remember, this method alters the default session-timeout interval only for the session associated with the users who request this servlet. Why would some users get a different timeout interval than others? Perhaps web-user testing at your organization has indicated that a session timeout of five minutes is more appropriate for your shopping cart-related servlets, whereas some chart- or map-creation servlets require the default timeout of 30 minutes or more, since their users might linger over the complex images in their browsers for a long period.

In most web applications, the session timeout is set (or altered) in the deployment descriptor, and you will not have to dynamically change the timeout in the servlet code.

See Also

Recipe 11.1 on configuring the session timeout; Recipe 11.2 on setting the session timeout in all Tomcat applications; Recipe 11.4 on checking the validity of a session; Chapter 1 on web.xml; Chapter 7 of the Servlet v2.3 and v2.4 specifications on sessions; the session-tracking sections of Java Servlet Programming by Jason Hunter (O'Reilly) and JavaServer Pages by Hans Bergsten (O'Reilly).

    [ Team LiB ] Previous Section Next Section