Recipe 11.3 Setting the Session Timeout Programmatically

Problem

You want to set a session timeout in your servlet code.

Solution

Use the HttpServletRequest object's getSession( ) method to get a reference to the HttpSession object. Then change the timeout period programmatically by using the HttpSession.setMaxInactiveInterval(int seconds) method.

Discussion

The HttpSession.setMaxInactiveInterval(int seconds) method sets the timeout for a session individually, so that only the particular session object being operated upon is affected. Other servlets that do session tracking in the web application still use the session-timeout value in web.xml or, in the absence of this element, the server's default session-timeout value. Example 11-5 checks the timeout period for a session, then resets that timeout period to 20 minutes.

Example 11-5. Resetting a default timeout period

package com.jspservletcookbook;           

import java.util.Date;
import java.text.DateFormat;

import javax.servlet.*;
import javax.servlet.http.*;

public class SimpleSession extends HttpServlet {
  
 public void doGet(HttpServletRequest request, 
   HttpServletResponse response)
    throws ServletException, java.io.IOException {
        
        response.setContentType("text/html");
        java.io.PrintWriter out = response.getWriter( );

        HttpSession session = request.getSession( );
        
        out.println("<html>");
        out.println("<head>");
        out.println("<title>Simple Session Tracker</title>");
        out.println("</head>");
        out.println("<body>");
        
        out.println("<h2>Session Info</h2>");

        out.println("session ID: " + session.getId( ) + "<br><br>");

        out.println( "The SESSION TIMEOUT period is " + 
            session.getMaxInactiveInterval( ) + " seconds.<br><br>");

        out.println( "Now changing it to 20 minutes.<br><br>");

        session.setMaxInactiveInterval(20 * 60);

        out.println("The SESSION TIMEOUT period is now " + 
            session.getMaxInactiveInterval( )  + " seconds.");
        
        out.println("</body>");
        out.println("</html>");
        
    }
}

Figure 11-2 shows the result of requesting this servlet in a web browser.

Figure 11-2. Getting session-timeout info

This servlet gets the HttpSession object with the HttpServletRequest class's getSession( ) method.

Whatever the servlet's default timeout period is, say, 30 minutes, Example 11-5 changes the accessed session's timeout to 20 minutes:

session.setMaxInactiveInterval(20 * 60);

Remember, this method alters the default session-timeout interval only for the session associated with the users who request this servlet. Why would some users get a different timeout interval than others? Perhaps web-user testing at your organization has indicated that a session timeout of five minutes is more appropriate for your shopping cart-related servlets, whereas some chart- or map-creation servlets require the default timeout of 30 minutes or more, since their users might linger over the complex images in their browsers for a long period.