Spring Why session get expired before session-timeout?

Question

I am using Spring security authentication and after successful logis is session set. I have configured session-timeout on 10 minutes, but session is removed after few minutes. I don't know why.

Here is debug output:

2013-09-13 12:34:29 DEBUG HttpSessionEventPublisher:83 - Publishing event: org.springframework.security.web.session.HttpSessionDestroyedEvent[source=org.apache.catalina.session.StandardSessionFacade@5d67c24a]
2013-09-13 12:34:29 DEBUG SessionRegistryImpl:156 - Removing session CA174F1B4B889FFDBF47E22C7C4D5A0B from principal's set of registered sessions
2013-09-13 12:34:29 DEBUG SessionRegistryImpl:164 - Removing principal org.springframework.security.core.userdetails.User@d50fea1e: Username: tester; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_MANAGER,ROLE_USER from registry

web.xml

<session-config>
    <session-timeout>10</session-timeout>
</session-config>

Check your code this is the reason in my case, i played with cookied https://stackoverflow.com/a/34859446/944593 — shareef, Oct 10 '18 at 07:04

score 0 · Answer 1 · answered Sep 13 '13 at 11:36

0

Session timeout can be overridden by various means. See http://docs.oracle.com/javaee/1.3/api/javax/servlet/http/HttpSession.html#setMaxInactiveInterval(int). Make sure there isn't anything else that is overriding it (Web/App server, framework, ...).

answered Sep 13 '13 at 11:36

superbob

1,628
13
24

I'm using apache tomcat but there is value 30 in web.xml. – misco Sep 13 '13 at 12:00
Do you use a recent version of tomcat ? Do you use a filtering mechanism that could override timouts ? – superbob Sep 13 '13 at 13:39

Spring Why session get expired before session-timeout?

1 Answers1

Linked