setMaxInactiveInterval on OC4J isn't accurate

Question

I've a servlet app deployed in side oc4j.

I am trying to invalidate the user session after 1 minute using:

session.setMaxInactiveInterval(1 * 60);

But What happens is that It takes over 1 minute (and may reach 1 min and half) before the session get destroyed.

Is this an implementation issue, or what?

Answer 1

You seem to be checking the destroy by waiting until HttpSessionListener#sessionDestoryed() get called instead of actually sending a HTTP request to the server after exactly 1 minute.

The session destroy is on most servers managed by a background job which runs at intervals, which can be each minute or more depending on server make/version, configuration and possibly also load. This job checks all open sessions whether it has been expired or not and sweeps the expired ones accordingly. Thus, it is not true that the session destroy is immediately called on the same second as the session is expired as long as the client hasn't sent a request. This background job does not run every second, it would have been too CPU intensive.

The session destroy will however be immediately called whenever the server retrieves a request with a session ID while the session is still present in server's memory but is been expired.

So, you'd either have to accept it or to change your testing methodology.