Since <session-config> element in web.xml is optional, What will be the session timeout,if we don't have it in web.xml? Will sessions be timed out at all? Or will there be a container specific time out value out of web.xml? This has not been mentioned in servlet specifications. Thanks.