JSESSIONID Cookie with Expiration Date in Tomcat

Question

What's the best way to set an expiration date for the JSESSIONID cookie sent by Tomcat for a servlet session?

By default, the expiration date of the cookie seems to be 'session', which means that the session disappears in the client as soon as the browser restarts. But I would like to keep it open for 12h, even after a browser restart (and would then configure the session timeout in the server accordingly).

Is there any way to set an expiration date within Tomcat, e.g. using some configuration option or extension module? Or is there a reliable way to set an expiration date for JSESSIONID using a Servlet filter?

Answer 1

As of Servlet 3.0, this can simply be specified in the web.xml:

<session-config>
    <session-timeout>720</session-timeout> <!-- 720 minutes = 12 hours -->
    <cookie-config>
        <max-age>43200</max-age> <!-- 43200 seconds = 12 hours -->
    </cookie-config>
</session-config>

Note that session-timeout is measured in minutes but max-age is measured in seconds.

Answer 2

I don't think it's possible to do what you want, without changing the Tomcat code.

Note however that it might have a nasty side effect : if a user starts a session and stays active for twelve hours, its session timeout will be updated accordingly (the timeout will be updated at each request), but its cookie won't, and the user will thus lose its session after 12 hours, even if he's been active all this time.