Session timeout with security bug?

[Kevin McDonald]

I'm using FORM based authentication and I set my session-timeout to 1.
After 2 minutes I hit a protected page and the session ID changed, 
I lost my session objects, but Tomacat didn't make me reauthenticate. 
Has anybody else seen this? 
Is there a config setting for this?

Tomcat 3.2.1 jdk1.2.2

Thanx,
Kevin


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]