CODEWITHSUNDEEP
javaxmlsession
Zues
Zues

Reputation: 19

how does session timeout configured in web.xml works

I have this piece of code configured in my web.xml file to validate a user session.

<session-config> <session-timeout>30</session-timeout> </session-config>

i want to understand its internal working as to how a particular user is validated and where, when a user makes a request after 30 mins.

Upvotes: 1

Views: 1987

Answers (1)

siom
siom

Reputation: 1807

A "session" is identified by the JSESSIONID identifier send with every request by the client (e.g. browser). This identifier is either send per cookie or by request parameter (query parameter). The web container maintains a map of all active sessions under their JSESSIONID identifier. If the configured timeout has passed by without any request for this JSESSIONID identifier, then the session is seen as "timed out". All data you have put into this session is lost (incl. eventual authentication information).

Upvotes: 2

Related Questions