Configure JSESSIONID Cookie to expire at specific point in time

Question

I am working with WildFly 11 and JSF/Primefaces.

I would like my user's session cookies to expire at a specific point in time, lets say today at midnight.

I understand that I can configure

<session-config>
    <cookie-config>
        <max-age>3600</max-age>
     </cookie-config>
</session-config>

in my web.xml to set the max-age of the session cookie.

But how can I set a dynamic value like

<session-config>
    <cookie-config>
        <max-age>calculateMaxAgeForThisSpecificLogin()</max-age>
     </cookie-config>
</session-config>

I would be thankful for any hint in the right direction.

edit: To clarify: I understand that i can set the session timeout like this:

<session-config>
    <session-timeout>30</session-timeout>
</session-config>

Or alternatively, the session timeout can be set dynamically in the application code. Unfortunately, this will not address the issues that I am faced with:

1. The session-timeout will destroy the session on the server side when there are no requests generated for the specified amount of time. There is no way to predict when this will be. If the browser continues to generate requests (i.e. a bug), the session will never be destroyed. As far as I understand, setting a timeout is no way to ensure the session will be destroyed at a specific point in time.
2. If not specified otherwise, the session cookie will live until the browser is closed. In my inhouse corporate environment, this can very well mean forever as many users just lock their workstations but never close their browsers. Even if the session is invalidated on the server side, the browser will still send a possibly very old session cookie. Per default, the JSESSIONID cookie contains a server part after the last dot (i.e. "...app-server-1") which is used by the load balancers to evaluate the appropriate route. Sending old session cookies may lead to unintended routes over the loadbalancers, causing further issues in respect to version management.

So, setting max-age will help as the browsers will stop to send very old session cookies.

My question aims about setting a specific point in time for the JSESSIONID cookie to be able to align load balancing and version management with session lifetime and browser behavoir.

Answer 1

Use Filter :

public class SampleFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        int cookieAge = 3600 ; //Or load from config file or database
        request.getSession().setMaxInactiveInterval(cookieAge);

        filterChain.doFilter(servletRequest,servletResponse);
    }

    @Override
    public void destroy() {

    }
}