On 04.11.2016 20:06, Mark Thomas wrote:
On 04/11/2016 15:53, Caldarale, Charles R wrote:
From: Mark Thomas [mailto:ma...@apache.org] Subject: Re:
MaxInactiveInterval
On 04/11/2016 15:07, André Warnier (tomcat) wrote:
A log message in an application running under Tomcat 8 mentions
the "MaxInactiveInterval" setting, saying that it is a bit
short..
I think that I understand the meaning of the setting (the time
for which a session remains valid, even without interactions).
But where in the webapp context, and under what name, should an
equivalent parameter be specified ?
Set it in web.xml. Same with distributable.
This really appears to be a problem in the servlet spec (not
surprising), which mentions the getMaxInactiveInterval() and
setMaxInactiveInterval() APIs but only vaguely ties them to the
session-timeout element of session-config. Tomcat doc does not
normally describe the nuances of the servlet spec, but something that
associates the config name with the API might be useful.
To be fair, Tomcat isn't helping here. We used to have these attributes
on the (session) manager but we removed with the expectation that they
would be configured in web.xml. We could have done a better job of
pointing to the expected locations.
I did say "patches welcome" to André but since he is a committer that
should have been "commits welcome" ;)
Guys, you all know my level of (in)competence in matters deeply Java.
I got my kudos by trying to help people in a general sense here, but when things seem to
involve specific parts deep down the Tomcat code, I have to call for help.
What I know is this, from the Servlet Specs 3.0 final :
quote
12. session-config Element
The session-config defines the session parameters for this Web application.
The sub-element *session-timeout* defines the default session time out interval
for all sessions created in this Web application. The specified time out must be
expressed in a whole number of minutes. If the time out is 0 or less, the
container
ensures the default behavior of sessions is never to time out. If this element
is not
specified, the container must set its default time out period.
unquote
So it appears that there is a difference between :
- the WEB-INF/web.xml of a webapp specifying a session-timeout > 0, in minutes
- the WEB-INF/web.xml of a webapp specifying a session-timeout =< 0 (meaning, no timeout
or "infinite")
- the WEB-INF/web.xml of a webapp not specifying a session-timeout (container should
supply a default value)
Which thus raises the question : if a web application does not set the session-timeout,
what value is returned by Tomcat for getMaxInactiveInterval() ?
And the auxiliary question : can this (default) value be set somewhere in the
configuration, or is this set in code ?
(Or is that the one that is set in (tomcat)/conf/web.xml :
<session-config>
<session-timeout>30</session-timeout>
</session-config>
?)
(and what happens if we remove that stanza from conf/web.xml ?)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
