Configuring Session Timeout and Session Invalidation in Java Servlets

Course: Advanced Java Training

Topic: Configuring Session Timeout and Session Invalidation

Course Link: Advanced Java Training Course

Demo Link: Register for a Free Course Demo

Website: JustAcademy Official Website

1. Introduction to Session Timeout and Session Invalidation

In Java web applications, an HTTP session allows the server to maintain user-specific information across multiple requests. Since HTTP is stateless, a servlet application can use the HttpSession interface to store information such as logged-in user details, shopping cart items, temporary preferences, and workflow data.

Session timeout and session invalidation are important parts of session management. They help applications remove inactive sessions, release server resources, and prevent old session data from remaining available longer than necessary.

• Session timeout: Automatically expires a session after a configured period of inactivity.
• Session invalidation: Explicitly ends a session and removes its session attributes.
• Session configuration: Defines how long a session can remain inactive before it expires.

2. What Is an HTTP Session?

An HTTP session represents a user's interaction with a web application over multiple HTTP requests. A servlet container creates and manages the session, typically identifying it through a session ID carried in a cookie or another supported session-tracking mechanism.

In Java Servlets, the HttpSession interface provides methods to create, access, update, configure, and invalidate sessions.

import jakarta.servlet.http.HttpSession;

// Create a session if one does not already exist
HttpSession session = request.getSession();

// Store data in the session
session.setAttribute("username", "Rahul");

// Retrieve data from the session
String username = (String) session.getAttribute("username");

Note: The examples in these notes use the Jakarta Servlet API and jakarta.servlet imports, commonly used with modern servlet containers such as Tomcat 10 and later. Older Java EE projects may use javax.servlet imports.

3. Understanding Session Timeout

Session timeout is the maximum period a session can remain inactive between client requests before the servlet container invalidates it. The inactivity period is measured between requests associated with the session, not simply by how long a browser window stays open.

For example, if a session timeout is configured for 15 minutes and the user makes no further requests associated with the session during that period, the session becomes eligible for expiration according to the servlet container's session-management behavior.

Why Is Session Timeout Important?

• Security: Reduces the time sensitive information remains associated with an inactive session.
• Resource management: Helps the server clean up sessions that are no longer being used.
• User experience: Allows applications to define reasonable inactivity periods.
• Application control: Supports different timeout policies for different applications or user workflows.

4. Important HttpSession Methods

5. Configuring Session Timeout Using setMaxInactiveInterval()

The setMaxInactiveInterval() method configures the maximum inactive period for a particular session. Its argument is measured in seconds.

Syntax

session.setMaxInactiveInterval(seconds);

Example: Setting a 15-Minute Session Timeout

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.io.IOException;

@WebServlet("/start-session")
public class StartSessionServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request,
                         HttpServletResponse response)
            throws ServletException, IOException {

        HttpSession session = request.getSession();

        // Set session inactivity timeout to 15 minutes
        session.setMaxInactiveInterval(15 * 60);

        session.setAttribute("username", "Rahul");

        response.setContentType("text/plain");
        response.getWriter().println("Session created successfully.");
        response.getWriter().println(
            "Timeout: " + session.getMaxInactiveInterval() + " seconds"
        );
    }
}

Explanation

1. request.getSession() retrieves the current session or creates a new one.
2. setMaxInactiveInterval(15 * 60) sets the timeout to 900 seconds, which equals 15 minutes.
3. setAttribute() stores the username for later requests.
4. getMaxInactiveInterval() retrieves the configured timeout.

This setting applies to the session object being configured. It does not automatically change the timeout for every session in the application.

6. Configuring a Default Session Timeout in web.xml

The deployment descriptor, web.xml, allows developers to configure a default session timeout for a web application. The value is specified in minutes rather than seconds.

Example: Setting a 20-Minute Timeout

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
         https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
         version="6.0">

    <session-config>
        <session-timeout>20</session-timeout>
    </session-config>

</web-app>

Explanation

• <session-config> contains the session-related configuration.
• <session-timeout>20</session-timeout> specifies 20 minutes of inactivity.
• The configured value is a default for the web application's sessions unless changed for an individual session or through other applicable configuration.
• Place web.xml in the application's WEB-INF directory.

Important: The deployment descriptor's timeout is measured in minutes, whereas setMaxInactiveInterval() uses seconds.

7. Configuring Timeout Programmatically with ServletContext

In supported Jakarta Servlet versions, the application-wide default session timeout can also be configured programmatically through ServletContext.setSessionTimeout(). This value is expressed in minutes and is normally configured during application initialization.

Example Using a ServletContextListener

import jakarta.servlet.ServletContext;
import jakarta.servlet.ServletContextEvent;
import jakarta.servlet.ServletContextListener;
import jakarta.servlet.annotation.WebListener;

@WebListener
public class SessionTimeoutConfig implements ServletContextListener {

    @Override
    public void contextInitialized(ServletContextEvent event) {
        ServletContext context = event.getServletContext();

        // Set the default timeout to 25 minutes
        context.setSessionTimeout(25);
    }
}

Use either the deployment descriptor or programmatic configuration according to the application's requirements and servlet version. Avoid maintaining conflicting configuration values without a clear reason.

8. What Is Session Invalidation?

Session invalidation is the process of explicitly ending an HTTP session. The invalidate() method tells the servlet container that the session is no longer valid. Session attributes are unbound, and later requests cannot continue using that invalidated session as an active session.

Common Reasons to Invalidate a Session

• When a user logs out.
• When an account is deactivated or access is revoked.
• When a multi-step workflow is completed or abandoned.
• When a security-sensitive event requires the current session to end.
• When an administrator or application workflow requires session termination.

9. Invalidating a Session Manually

The following example shows how to invalidate a session when a user clicks a logout link or submits a logout request.

Example: LogoutServlet

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.io.IOException;

@WebServlet("/logout")
public class LogoutServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest request,
                          HttpServletResponse response)
            throws ServletException, IOException {

        HttpSession session = request.getSession(false);

        if (session != null) {
            session.invalidate();
        }

        response.sendRedirect(
            request.getContextPath() + "/login.html"
        );
    }
}

How It Works

1. request.getSession(false) checks for an existing session without creating a new one.
2. If a session exists, session.invalidate() terminates it.
3. If no session exists, the servlet safely skips invalidation.
4. sendRedirect() sends the browser to the login page.

Security note: Logout should generally be implemented as a POST request protected against cross-site request forgery (CSRF), rather than as a state-changing GET request. The login page in this example is assumed to be available at /login.html; change the destination to match your application.

10. Difference Between Session Timeout and Session Invalidation

11. Checking Whether a Session Exists

Use request.getSession(false) when you want to check for a session without accidentally creating a new one. This is particularly useful in authentication checks and logout handlers.

HttpSession session = request.getSession(false);

if (session == null) {
    response.sendRedirect(
        request.getContextPath() + "/login.html"
    );
    return;
}

Object username = session.getAttribute("username");

if (username == null) {
    session.invalidate();
    response.sendRedirect(
        request.getContextPath() + "/login.html"
    );
    return;
}

// Continue processing the authenticated request

This example demonstrates a basic session check. Real applications should use a consistent authentication mechanism, appropriate error handling, and authorization checks for protected resources.

12. Building a Complete Session Timeout and Logout Example

This example demonstrates session creation, timeout configuration, session attribute retrieval, and logout.

Step 1: Create a Session

import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import jakarta.servlet.ServletException;
import java.io.IOException;

@WebServlet("/login-demo")
public class LoginDemoServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest request,
                          HttpServletResponse response)
            throws ServletException, IOException {

        String username = request.getParameter("username");

        if (username == null || username.isBlank()) {
            response.sendError(
                HttpServletResponse.SC_BAD_REQUEST,
                "Username is required."
            );
            return;
        }

        HttpSession session = request.getSession();
        session.setMaxInactiveInterval(10 * 60);
        session.setAttribute("username", username);

        response.sendRedirect(
            request.getContextPath() + "/dashboard"
        );
    }
}

Step 2: Access the Protected Dashboard

@WebServlet("/dashboard")
public class DashboardServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request,
                         HttpServletResponse response)
            throws ServletException, IOException {

        HttpSession session = request.getSession(false);

        if (session == null ||
            session.getAttribute("username") == null) {

            response.sendRedirect(
                request.getContextPath() + "/login.html"
            );
            return;
        }

        String username =
            (String) session.getAttribute("username");

        response.setContentType("text/html;charset=UTF-8");
        response.getWriter().println(
            "<h1>Welcome, " + escapeHtml(username) + "!</h1>"
        );
        response.getWriter().println(
            "<form method='post' action='" +
            request.getContextPath() +
            "/logout'><button type='submit'>Logout</button></form>"
        );
    }

    private String escapeHtml(String value) {
        return value.replace("&", "&")
                    .replace("<", "<")
                    .replace(">", ">")
                    .replace("\"", """)
                    .replace("'", "'");
    }
}

Note: The dashboard example illustrates session checking and HTML escaping. A production application should use a proper template engine, validate authentication against trusted credentials, protect state-changing requests against CSRF, and avoid treating a user-supplied username as proof of identity.

Step 3: Log Out

Use the LogoutServlet from Section 9 to invalidate the current session. After logout, requests to protected pages should require authentication again.

13. Understanding Session Timeout Behavior

Session expiration is based on inactivity associated with client requests. A session timeout does not mean that the browser automatically closes, and it does not necessarily mean the user immediately sees a message when the timeout elapses.

• The browser may still display a previously loaded page after the server-side session expires.
• The next request to a protected resource should detect the missing or invalid session and redirect the user to sign in again.
• Requests that access the session can update its last-access time; merely changing an attribute in application code should not be relied upon to keep the session active.
• Expiration is managed by the servlet container, so exact cleanup timing may depend on the implementation.
• Session timeout is not a replacement for authorization checks or server-side credential validation.

14. Security Best Practices for Session Management

• Choose a reasonable timeout: Use shorter inactivity periods for applications that handle sensitive data.
• Invalidate sessions on logout: Do not merely redirect the user or remove only the username attribute.
• Regenerate the session after authentication: Prevent session fixation by using the appropriate session-ID rotation mechanism, such as request.changeSessionId() where supported.
• Protect session cookies: Configure Secure, HttpOnly, and an appropriate SameSite policy.
• Use HTTPS: Protect session identifiers while they travel between the browser and server.
• Check authorization on every protected request: A valid session alone does not prove that a user can access every resource.
• Avoid exposing session IDs: Never print session identifiers in public responses or application logs unnecessarily.
• Handle expired sessions gracefully: Redirect users to authentication with a clear message where appropriate.
• Protect logout and other state-changing requests: Use CSRF defenses and suitable HTTP methods.
• Do not store unnecessary sensitive information: Keep session data limited to what the application needs.

15. Common Errors and Troubleshooting

16. Practical Exercises

Exercise 1: Configure a Five-Minute Timeout

• Create a servlet that creates or retrieves a session.
• Set the inactivity timeout to 300 seconds.
• Display the configured timeout using getMaxInactiveInterval().
• Test the application with no requests for more than five minutes.

Exercise 2: Implement Logout

• Create a session and store a username attribute.
• Build a logout endpoint that uses POST.
• Invalidate the existing session.
• Verify that a protected page redirects the user after logout.

Exercise 3: Compare Application and Session Timeouts

• Configure the default timeout in web.xml.
• Override the timeout for one session using setMaxInactiveInterval().
• Compare the values returned by getMaxInactiveInterval().
• Document which configuration applies to each test session.

17. Mini Project: Secure Session-Based Dashboard

Project objective: Create a simple Java Servlet application with session-based login state, automatic inactivity timeout, a protected dashboard, and logout functionality.

Project Requirements

1. Create a login form that submits credentials using POST.
2. Validate credentials on the server before establishing an authenticated session.
3. Configure a 10-minute session inactivity timeout.
4. Store the authenticated user's identifier in the session.
5. Restrict dashboard access to authenticated users.
6. Invalidate the session on logout.
7. Redirect users whose sessions have expired to the login page.
8. Test session timeout, logout, and direct access to protected URLs.

Expected Result

The application should permit access to the dashboard only when a valid authenticated session exists. After logout or expiration, the user should be required to authenticate again. For production use, add password hashing, secure cookies, CSRF protection, HTTPS, and appropriate access-control checks.

18. Interview Questions and Answers

Q1. What is session timeout in Java Servlets?

Session timeout is the maximum period of inactivity allowed before the servlet container invalidates a session.

Q2. Which method configures the timeout for an individual session?

The setMaxInactiveInterval(int seconds) method of HttpSession configures the session's inactivity interval in seconds.

Q3. How do you configure a default session timeout in web.xml?

Use the <session-config> element and specify the inactivity period in minutes with <session-timeout>.

Q4. What does session.invalidate() do?

It invalidates the session and unbinds the objects stored as session attributes.

Q5. What is the difference between getSession() and getSession(false)?

getSession() returns the current session or creates one if necessary. getSession(false) returns an existing session or null without creating a new one.

Q6. What happens if you access a session after invalidating it?

Operations on the invalidated session can throw IllegalStateException. The application should not continue using that session object.

Q7. Can a session timeout be disabled?

The Servlet API defines a zero or negative inactivity interval as a session that does not time out due to inactivity. Avoid this configuration for sensitive applications unless there is a specific, carefully evaluated requirement.

Q8. Is session timeout measured in minutes or seconds?

web.xml and ServletContext.setSessionTimeout() use minutes, while HttpSession.setMaxInactiveInterval() uses seconds.

Q9. Does closing a browser always invalidate a session immediately?

No. Browser closure does not reliably notify the server that the session should be invalidated. The session may remain until its timeout or until application code invalidates it.

Q10. Why should logout invalidate the session?

Invalidating the session removes the current server-side session state and helps prevent subsequent requests from reusing that session as an authenticated session.

19. Quick Revision Checklist

• Understand the purpose of HttpSession.
• Know the difference between inactivity timeout and manual invalidation.
• Use setMaxInactiveInterval() for per-session timeout configuration.
• Remember that setMaxInactiveInterval() uses seconds.
• Configure application defaults using web.xml or supported programmatic configuration.
• Remember that the deployment descriptor timeout uses minutes.
• Use request.getSession(false) to check for an existing session without creating one.
• Call session.invalidate() when logging out.
• Do not access an invalidated session object.
• Protect authenticated routes and apply secure cookie settings.
• Test timeout and logout behavior using actual browser requests.

20. Conclusion

Configuring session timeout and session invalidation is essential for managing user state in Java web applications. Session timeouts help remove inactive sessions automatically, while invalidate() explicitly ends a session when the user logs out or the application needs to terminate the current session.

By using the HttpSession API correctly, configuring appropriate inactivity periods, validating access to protected resources, and applying secure session-management practices, developers can build more reliable and secure servlet-based applications.

To learn more about enterprise Java development, explore the Advanced Java Training Course, register for a course demo, or visit the JustAcademy website.