I have a simple web application, created with vaadin UI of JVx application framework.
I want to configure the session timeout for the application and don't know where the configuration should be placed.
The application should be valid as long as the browser is open. After the browser/tab is closed, the session should time-out.
I tried to set the session timeout via web.xml:
<session-config>
<session-timeout>30</session-timeout>
</session-config>
but this is a general timeout after 30 minutes inactivity. My application should not time-out if there's no user activity. Only if no application is used.
Try setting:
<servlet>
<servlet-name>VaadinUI</servlet-name>
<servlet class>com.sibvisions.rad.ui.vaadin.server.VaadinServlet</servlet-class>
...
<!-- milliseconds -->
<init-param>
<param-name>push.pollingInterval<param-name>
<param-value>14000</param-name>
</init-param>
<!-- seconds -->
<init-param>
<param-name>sessionTimeout<param-name>
<param-value>180</param-name>
</init-param>
<!-- seconds -->
<init-param>
<param-name>heartbeatInterval<param-name>
<param-value>50</param-name>
</init-param>
<init-param>
<param-name>closeIdleSessions<param-name>
<param-value>false</param-name>
</init-param>
<!-- seconds -->
<init-param>
<param-name>Application.connection.timeout<param-name>
<param-value>120</param-name>
</init-param>
</servlet>
The most important setting is closeIdleSessions. If it's true, sessions without user interaction are closed. The heartbeatInterval every 50 seconds configures the keepalive request from the client(browser) to the server and is also the notification that the application is still in use.
The push.pollingInterval is optional and possibly relevant if you have problems with load balancers, because many load balancer configurations will close the websocket if it's inactive. This setting sends a request every 14 seconds.
The Application.connection.timeout is also optional. It's only for the application because it's possible that the http-session has a longer timeout than the application. In this case, the application shows the login before the session will time-out.
The official vaadin documentation has more details. The JVx framework documentation contains additional information about the application connection timeout.