Recipe 11.3 Setting the Session Timeout Programmatically

Problem

You want to set a session timeout in your servlet code.

Solution

Use the HttpServletRequest object's getSession( ) method to get a reference to the HttpSession object. Then change the timeout period programmatically by using the HttpSession.setMaxInactiveInterval(int seconds ) method.

Discussion

The HttpSession.setMaxInactiveInterval(int seconds ) method sets the timeout for a session individually , so that only the particular session object being operated upon is affected. Other servlets that do session tracking in the web application still use the session-timeout value in web.xml or, in the absence of this element, the server's default session-timeout value. Example 11-5 checks the timeout period for a session, then resets that timeout period to 20 minutes.

Example 11-5. Resetting a default timeout period

 package com.jspservletcookbook;            import java.util.Date; import java.text.DateFormat; import javax.servlet.*; import javax.servlet.http.*; public class SimpleSession extends HttpServlet {     public void doGet(HttpServletRequest request,     HttpServletResponse response)     throws ServletException, java.io.IOException {                  response.setContentType("text/html");         java.io.PrintWriter out = response.getWriter( );  HttpSession session = request.getSession( );  out.println("<html>");         out.println("<head>");         out.println("<title>Simple Session Tracker</title>");         out.println("</head>");         out.println("<body>");                  out.println("<h2>Session Info</h2>");         out.println("session ID: " + session.getId( ) + "<br><br>");         out.println( "The SESSION TIMEOUT period is " +              session.getMaxInactiveInterval( ) + " seconds.<br><br>");  out.println( "Now changing it to 20 minutes.<br><br>");         session.setMaxInactiveInterval(20 * 60);  out.println("The SESSION TIMEOUT period is now " +              session.getMaxInactiveInterval( )  + " seconds.");                  out.println("</body>");         out.println("</html>");              } }

Figure 11-2 shows the result of requesting this servlet in a web browser.

Figure 11-2. Getting session-timeout info

This servlet gets the HttpSession object with the HttpServletRequest class's getSession( ) method.

Whatever the servlet's default timeout period is, say, 30 minutes, Example 11-5 changes the accessed session's timeout to 20 minutes:

 session.setMaxInactiveInterval(20 * 60);

Remember, this method alters the default session-timeout interval only for the session associated with the users who request this servlet. Why would some users get a different timeout interval than others? Perhaps web- user testing at your organization has indicated that a session timeout of five minutes is more appropriate for your shopping cart- related servlets, whereas some chart- or map-creation servlets require the default timeout of 30 minutes or more, since their users might linger over the complex images in their browsers for a long period.

In most web applications, the session timeout is set (or altered ) in the deployment descriptor, and you will not have to dynamically change the timeout in the servlet code.