I am trying to get control of session timeout interval in a
JBoss (3.2) application served under apache. In production this will be run in a two-server cluster with sticky sessions, but never mind that, I can't even get it to work unclustered.
Current web.xml defines <session-timeout>60</session_timeout>.
But we need to set it to 4 hours (240). However, I can't prove that the value in web.xml is even looked at by Jboss. If, as an experiment, I set <session-timeout>1</session_timeout> so that the session will time out after one minute, I wait for two minutes and find the session still is valid. It appears, then, that something is overriding the setting in web.xml? What might that be, and how can I configure the system so that the session-timeout value is respected?
