This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 960ff2d58ec13d06f29a164f5074948fe86ac72c Author: lprimak <[email protected]> AuthorDate: Wed Oct 21 11:46:54 2026 -0500 bugfix: adjust session timeout calculation to round up positive millisecond values --- .../main/java/org/apache/shiro/web/session/HttpServletSession.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/apache/shiro/web/session/HttpServletSession.java b/web/src/main/java/org/apache/shiro/web/session/HttpServletSession.java index 5ef1484f4..337957e3b 100644 --- a/web/src/main/java/org/apache/shiro/web/session/HttpServletSession.java +++ b/web/src/main/java/org/apache/shiro/web/session/HttpServletSession.java @@ -90,7 +90,11 @@ public class HttpServletSession implements Session { @SuppressWarnings("checkstyle:MagicNumber") public void setTimeout(long maxIdleTimeInMillis) throws InvalidSessionException { try { - int timeout = (int) (maxIdleTimeInMillis / 1000); + // HttpSession timeouts are in whole seconds + // round positive millisecond values up to the next second to avoid converting them to never expire. + long timeoutInSeconds = maxIdleTimeInMillis < 0 + ? -1 : maxIdleTimeInMillis / 1000 + (maxIdleTimeInMillis % 1000 == 0 ? 0 : 1); + int timeout = (int) Math.min(timeoutInSeconds, Integer.MAX_VALUE); httpSession.setMaxInactiveInterval(timeout); } catch (Exception e) { throw new InvalidSessionException(e);
