Define custom events/actions/requests for resetting timer for Session Timeout in Java Web App?

Question

I am using Tomcat 7.0, Spring 4.0.2, Web Module 3.0 in eclipse for my web application. And I configured my session timeout in app/web.xml as well as tomcat/conf/web.xml.

<session-config><session-timeout>30</session-timeout></session-config>

I know that tomcat must reset it's internal timer for calculate this 30 mins and invalidate session (session timeout) on some events/actions/requests.

I am sending one request called captureLastActiveTimeForCurrentFile after every 5 mins. So now application server will never invalidate session because I am sending request after every 5 mins, so it will reset it's session timeout timer after every 5 mins.

Now my problem is that how to ignore any particular request (here, captureLastActiveTimeForCurrentFile) for resetting session timeout timer. It means when I send captureLastActiveTimeForCurrentFile request, server must not reset it's timer. For All others requests it should work as it is how it is already working. So suppose if I do not send any other (excluding captureLastActiveTimeForCurrentFile) requests to server, it must be invalidate session after 30 mins.

The solution I can think :
--> I will configure session timeout very long time in web.xml file.
--> I will capture last request time in one Global variable after every request call on server excluding captureLastActiveTimeForCurrentFile
--> I will start my own scheduler which will run after every 5 min and It will check last request time - current time > 30 mins, then I will invalidate session manually.

But I think this solution is complicated and performance wise not a good idea.

Is there any other way by which I can configure excluded requests on server, so that Server will ignore that particular request.

Correct me if any of my assumptions are wrong. Thanks in advance. Any help would be appreciate.

Answer 1

If the code behind captureLastActiveTimeForCurrentFile does not explicitly access the user's HTTP Session (i.e. by calling request.getSession()) then you can ignore the request to this path by setting some properties in Tomcat. Note that setting these however will introduce similar behavior for any other mappings not explicitly accessing the user's session.

The relevant properties are:

org.apache.catalina.core. StandardHostValve.ACCESS_SESSION org.apache.catalina.STRICT_SERVLET_COMPLIANCE

See further discussion here, especially the last post:

http://tomcat.10.x6.nabble.com/Session-timeouts-ignore-quot-periodic-polling-quot-URL-td2159572.html