Session Death

This is one of the most not obvious trigger in Web components. Because protocol doesn't demand to have continuous connection between the client making request and server keep on serving those request. And so most of the application contains a "Log out" button. True, on some event we can force session to die and here we are doing that on a button click. Time out value can be controlled in 3 ways:

- Global default - App Server has its own session timeout depending on the length of the session. Can't do anything with this.
- Webapps default - Here is the time to play with DD file. We can change the web.xml file to define the timeout and here is the small change:



Value here(40) goes in minute in session-timeout tag. But the most important is individual session setting

- Individual session setting: For this, we can write one line servlet code :

HttpSession.setMaxInactiveInterval(2400); // here time is in seconds.

Interesting part is defining 0 or negative in webapps default, leads to a never expired session whereas 0 means Immediate expire and negative means never, in Individual session setting. In HttpSession API, we can always kill the session by calling invalidate() method. So, on log-out button, just call this simple code.

In the next blog, I will try a simple code to see the session life cycle.