-1

I have configured following tag in my tomcat's web.xml. I waited for more than 2 minutes but still i am able to access the session. I came to know that there will be background thread run by tomcat to verify the expired sessions. I waited for more than 15 min still it seems this background thread not running .

Can Some one please let me know what is the http response code that we get when session is timed out ? Also how do i ensure that tomcat's background thread run's frequently?

 <session-config>
        <session-timeout>2</session-timeout>
    </session-config>
TEJA
  • 1
  • 6

3 Answers3

1

Tomcat is doing this out of the box, You don't have access to this. You won't have special http response, Tomcat is going over the session object that time out has reached and kill all objects.

In the next request to the server you will send Jsession(This is the sessionId the server is creating). The jsessionId won't find any session and you will see in the request empty session..

request.getSession(false) == null, or request.getSession(true).isNew().

This is the general explanation Hope that helps

Aviad
  • 1,539
  • 1
  • 9
  • 24
0

There is no specifict HTTP response code. The server will respond with a 200 OK or any other appropriate code. But your session will be empty.

0

It all depends on what you were using the HttpSession object for. If you were using it to hold some data indicating that a user was authenticated then it might be appropriate to respond with a 401 Unauthorized if the session has timed out.

bhspencer
  • 13,086
  • 5
  • 35
  • 44