this sets the session-timeout for the entire app to 10 minutes
<session-config>
<session-timeout>10</session-timeout>
</session-config>
you can check this setting by calling session.getMaxInactiveInterval() and you can change it dynamically by calling session.setMaxInactiveInterval(int seconds)
so basically -- they do the same thing -- one at run-time, one at deploy-time
-- You can find more info about this in the
Servlet 2.3 specification SRV.7.5