The short answer is 'Yes, you can'.
The slightly longer answer is that sessions are managed by the
servlet container and therefore the way you actually configure the session timeout is specific to a particular Application Server.
One way you can assist this is to write the current Date/Time on the session on each page hit, then
test this value when they hit the next page.
Dave.