JSESSIONID duration

Question

I have this doubt, what parameter does control timeouts for JSESSIONID?. Specifically consider this use case: I have a mobile client that it's mantaining session sending the cookie with the JSESSIONID header, however the client interacts with the application and left it in background for about 6 hours... the cookie stored in the client isn't deleted, and it's sent again back to the server... Will the JSESSIONID still be valid? What parameters or configuration determine the timeout of the cookie on the server?. Thanks a lot.

Answer 1

Its defined in web.xml e.g.

<session-config>
   <session-timeout>10</session-timeout>
</session-config> 

Will timeout in 10 mins

Answer 2

If your client is not hitting the app during session-timeout the session will expire automatically.

P.S.: refering to reevesy answer.