Servlet Session timeout

Question

I'm writing my SPring MVC web application.

I have set my session time out to be 10080 minutes equal to 1 week. Now I would like to keep user logged in every time he open browser:

sessionService.setcurrentUser(myuser);
      HttpSession session = request.getSession();
      Cookie cookie = new Cookie("JSESSIONID", session.getId());
      cookie.setMaxAge(timeout);
      response.addCookie(cookie);

Should my cookie Max Age be the same as session time out?

cookie.setMaxAge(10080);

Is it good practice?

Answer 1

You should configure it in web.xml, not by hacking the default session cookie.

<session-config>
    <session-timeout>10080</session-timeout>
</session-config>

Note that you shouldn't store too much data in session and/or that your server has enough memory.