JBridge: Certification Question Of The Day

From the list below, identify legitimate ways to impose a 30 minute session timeout. (2 correct answers)

<session-config>
	<session-timeout>30</session-timeout>
</session-config>

<servlet>
	<servlet-name>MyServlet</servlet-name>
	<servlet-class>uk.co.jbridge.servlet.MyServlet</servlet-class>
	<servlet-session-timeout>30</servlet-session-timeout>
</servlet>

<session-config>
	<session-timeout>1800</session-timeout>
</session-config>

The Answer

The correct answers are C and E. You can set a session to timeout using the element in web.xml, setting the time in minutes. You can also set the session timeout using the HttpSession method setMaxInactiveInterval – though this time you are dealing in seconds.
Answer A is completely made up.
In answer B, there is an invalidate() method in HttpSession – but it doesn’t take any parameter representing time or anything else. When this method is called, the session is immediately invalidated.
Answer D tries to persuade you that there is a way of configuring an individual servlet from web.xml to dictate session timeout. There is not.
Answer F is similar to correct answer E – but the timeout will be set to 30 seconds, not 30 minutes.
Answer G is similar to correct answer C – but the timeout will be set to 30 hours, not 30 minutes.