是否可以杀死Tomcat中的会话或强制会话过期（无论是活动的还是非活动的）？

Question

I need to know if its possible to set a forced session time-out at a WEB SERVER level, that basically after x period of time, kicks the user from the session either it is active or inactive or better saying WEBSERVER to delete the session linked to the client. Can this be achieved without development intervention on the application side? Is this possible to do it with Tomcat? Thank you.

Answer 1

You can do it through Tomcat default web.xml configuration

<session-config>
   <session-timeout>10</session-timeout>    <!-- 10 minutes -->
</session-config>

For full reference: https://tomcat.apache.org/tomcat-5.5-doc/appdev/web.xml.txt

The file can be located in conf/web.xml (relative to your tomcat installation)

Edit

You can also invalidate a given session using session.invalidate() method

Answer 2

you can set the time when you create a session using setMaxInactiveInterval(int interval); either make it constant or fetch from database depending on users time..!