You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Debbie Shapiro <DS...@cardiacscience.com> on 2010/09/14 18:29:45 UTC
session-timeout not taking effect
I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using the
default settings for the web.xml file for session-timeout (30 minutes),
but for some reason, the sessions aren't timing out at this point for
users of the web app. Is there some reason why this setting would be
ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
implementation.
Debbie Shapiro
Data Warehouse Manager
Cardiac Science Corporation * 3303 Monte Villa Parkway, Bothell, WA
98021
Office: 425.402.2233
Cardiac Science [NASDAQ: CSCX] provides defibrillation, ECG, stress,
rehab, and Holter devices that connect to EMR and HIS systems. Ask for
our Burdick(r), HeartCentrix(r), Powerheart(r), and Quinton(r) products,
services, supplies - and about our new products!
Visit our frequently updated blog at http://cardiacscience.com/blog
Re: session-timeout not taking effect
Posted by Mark Thomas <ma...@apache.org>.
On 14/09/2010 17:29, Debbie Shapiro wrote:
> I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using the
> default settings for the web.xml file for session-timeout (30 minutes),
> but for some reason, the sessions aren't timing out at this point for
> users of the web app. Is there some reason why this setting would be
> ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
> implementation.
Session time-out is explicitly tested as part of the test suite Tomcat
has to pass before we can claim compliance with the servlet specification.
It is possible that the app is setting its own session time-out. I'd
talk to InetSoft in the first instance.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it.
>
>
Well in that case why don't you set the testing workstation to time out after 5 minutes of
inactivity, lock up the screen and request a login to wake up ?
The infamous "this workstation is in use and has been locked" message, which I love so
much when I am installing software at a validated customer, go get a coffee, come back to
find my screen locked up, and find out that the person who unlocked it before has now gone
out for lunch.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] session-timeout not taking effect
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
André,
On 9/15/2010 7:44 PM, André Warnier wrote:
> Debbie Shapiro wrote:
>> Exactly. We have to follow FDA guidelines for validation of OTS
>> software and our validation expert is testing for this now. We want to
>> make sure that security is in place that if the app is left alone for
>> a period of time other users won't have access to it.
>>
> More seriously, if I was you I would kindly inform the vendor that their
> heartbeat feature is preventing their application from being validated
> by the FDA, and that in consequence they may be losing a big market
> share; and I would wait to see how long it takes before you obtain a
> 10.3 pre-release.
There is a workaround: write a Filter (you know how I love to write
Filters):
The filter would check the session for a special timestamp attribute. If
the current URL is /not/ the URL to the heartbeat, then update the
timestamp in the session. If it /is/ the heartbeat URL, then perform a
check: is the timestamp stored in the session older than - whatever you
want. If it is, call session.invalidate() and force the session to die.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkySYZsACgkQ9CaO5/Lv0PA1BwCeMf/Bsg4NFALRRgfRE4amvO7O
ZwkAn0/h5TQZaN202/2k+4CtukOIke0B
=+Jp7
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it.
>
More seriously, if I was you I would kindly inform the vendor that their heartbeat feature
is preventing their application from being validated by the FDA, and that in consequence
they may be losing a big market share; and I would wait to see how long it takes before
you obtain a 10.3 pre-release.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: André Warnier [mailto:aw@ice-sa.com]
Sent: Wednesday, September 15, 2010 12:34 PM
To: Tomcat Users List
Subject: Re: [OT] session-timeout not taking effect
Debbie Shapiro wrote:
> Sorry, I probably wasn't very clear in that email. I created a second IE instance and navigated to another page in that instance (suggestion made on another email here) to see if that would cause Tomcat to see the first page as inactive. It didn't.
>
Allright, that makes more sense then.
Now another question also just by curiosity : given that the developers of that
application have apparently taken pains that the session would /not/ expire while the page
is being displayed, why do you want it to expire ?
Is it so that the browser would not inadvertently stay open and logged-in while the user
is off getting a coffee ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> Sorry, I probably wasn't very clear in that email. I created a second IE instance and navigated to another page in that instance (suggestion made on another email here) to see if that would cause Tomcat to see the first page as inactive. It didn't.
>
Allright, that makes more sense then.
Now another question also just by curiosity : given that the developers of that
application have apparently taken pains that the session would /not/ expire while the page
is being displayed, why do you want it to expire ?
Is it so that the browser would not inadvertently stay open and logged-in while the user
is off getting a coffee ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
Sorry, I probably wasn't very clear in that email. I created a second IE instance and navigated to another page in that instance (suggestion made on another email here) to see if that would cause Tomcat to see the first page as inactive. It didn't.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: André Warnier [mailto:aw@ice-sa.com]
Sent: Wednesday, September 15, 2010 11:19 AM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
Debbie Shapiro wrote:
> Official response from InetSoft:
> ************************************************************************
> **********
> If you request for a report and leave it running in the browser in
> v10.2, the report will send a heartbeat beacon to the report server to
> let the server know that the report is still active, which will
> effectively keep the user session active.
Ok. But that still does not explain how the "session" (which according to your other
response does not seem to be linked to container-managed authentication) stays alive even
when you navigate away from that page (and to another website) in the browser.
From one of your previous posts, which showed a request URL received by the server, and
which URL contained something suggesting an AJAX mechanism, I would guess that the
following happens : the application page received triggers a call to a Javascript function
which starts running asynchronously in the background. This function makes periodic
requests to the server (what they call "hartbeat" above), and this prevents the timeout at
the server side.
But this function should only be running as long as the InetSoft application page is
displayed in the browser.
Once you navigate away (unless you do this in another instance of IE), that page is no
longer loaded, and the javascript heartbeat function could not be running anymore.
So it looks like there is something still unexplained here.
I'm just wondering about this by pure curiosity, because it does not seem to have anything
to do with Tomcat per se whatsoever.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Wesley Acheson <we...@gmail.com>.
Pretty much as I thought. My "tests" were designed with this result in
mind. Pretty bad way to test, I don't seem to help it though. I have
an assumption then test accordingly.
Anyway its using something called AJAX for other reasons. The downside
it it keeps your sessions alive. Glad you sorted it out though.
On Wed, Sep 15, 2010 at 6:13 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> Official response from InetSoft:
> ************************************************************************
> **********
> If you request for a report and leave it running in the browser in
> v10.2, the report will send a heartbeat beacon to the report server to
> let the server know that the report is still active, which will
> effectively keep the user session active.
>
> In v10.3, this has been enhanced so that the timeout value of the report
> will be taken into consideration, along with the heartbeat beacon
> mechanism instead of having the report be considered active if it is
> left open in the browser.
> ************************************************************************
> **********
>
> So, apparently, this is InetSoft's programming causing this, not a
> Tomcat bug and the settings are correct. Guess I just need to wait till
> 10.3... *sigh*.
>
>
>
>
>
>
> Debbie Shapiro, Data Warehouse Manager
> Office: 425.402.2233
>
> -----Original Message-----
> From: Debbie Shapiro
> Sent: Tuesday, September 14, 2010 4:17 PM
> To: 'Tomcat Users List'
> Subject: RE: session-timeout not taking effect
>
> waited an extra long time to test out the web page again, but it's still
> not timing out. I've asked InetSoft about the heartbeat requests. I'll
> update you all with what they say.
>
> Thanks! :-)
>
>
>
>
>
>
> Debbie Shapiro, Data Warehouse Manager
> Office: 425.402.2233
>
> -----Original Message-----
> From: Debbie Shapiro
> Sent: Tuesday, September 14, 2010 3:24 PM
> To: Tomcat Users List
> Subject: RE: session-timeout not taking effect
>
>
> I tested out navigating to another web page in a different window and
> coming back to the web app page after it should have timed out, but no
> go.
>
> I just removed the comments for the access log as you mentioned below.
> What I'm seeing in the access log are heartbeat requests? Like follows.
> I'm not touching the page and I did navigate to another page after I ran
> the report...
>
> 10.5.2.18 - - [14/Sep/2010:15:22:03 -0700] "POST
> /sree/Reports?op=heartbeat&ID=RA_QA[2f]PST[20]Complaints.12845027269201@
> local&&isAJAXRequest=true&isContainer=false&isXML=false HTTP/1.1" 200 -
>
> I don't know if this is because we're using LDAP for our security and
> InetSoft is checking this constantly. I have a feeling that's what it is
> though. :-(
>
>
>
> Debbie Shapiro, Data Warehouse Manager
> Office: 425.402.2233
>
> -----Original Message-----
> From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
> Sent: Tuesday, September 14, 2010 2:48 PM
> To: Tomcat Users List
> Subject: Re: session-timeout not taking effect
>
>
> On Tue, Sep 14, 2010 at 11:39 PM, Debbie Shapiro
> <DS...@cardiacscience.com> wrote:
>> I should add that I am neither a Java nor a Tomcat expert by any
> means.
>> Where would I find some of these settings?
>
> hmm may be a bit tricky
>>
>> I'm using IE to access this application.
>>
>> Where would one enable the access log? I essentially have the entire
>> Tomcat installation using the defaults at installation, with the
>> exception that I have included the InetSoft application directory in
> the
>> webapps folder.
> Is a valve usually on server.xml If you reciently downloaded tomcat
> and haven't played with these files there a commented out access log
> valve which you can uncomment
>
> ( i.e. remove <!-- and its end --> )
>
>> If I navigate to another website and immediately navigate back to the
>> InetSoft page, it first displays a page that the login has expired and
>> then prompts me to login again.
> I don't suppose you know if its using urlRewriting to keep sessions.
> There may be something in the browser address bar that says
> jsessionid.
>
>>It's only if I leave the page up that it
>> seems to not expire. My version of IE doesn't have tabs (I'm still on
>> 6.0), so it's either change the current window to a new page or open a
>> new window.
>
> Thats fine for the test. Change the current window by navigating to
> another site and back (You said before it asks you for a login). I'd
> advise a better browser however.
>
>> I'm not sure how to determine that the session-timeout is anything
> other
>> than 30 minutes aside from looking at the web.xml file. Not familiar
>> with JConsole. I don't currently have the Tomcat manager running. I
> just
>> found the documentation concerning that part of the app and I will see
>> about getting that started. As I said, I have everything set to the
>> defaults...
>>
>>
>
> Sorry for the stupid question but when you said the session should be
> expired, I assume you don't mean the report shouldn't still be on the
> screen.
>
> Is this a public website where someone could test?
>
> Wes
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> Official response from InetSoft:
> ************************************************************************
> **********
> If you request for a report and leave it running in the browser in
> v10.2, the report will send a heartbeat beacon to the report server to
> let the server know that the report is still active, which will
> effectively keep the user session active.
Ok. But that still does not explain how the "session" (which according to your other
response does not seem to be linked to container-managed authentication) stays alive even
when you navigate away from that page (and to another website) in the browser.
From one of your previous posts, which showed a request URL received by the server, and
which URL contained something suggesting an AJAX mechanism, I would guess that the
following happens : the application page received triggers a call to a Javascript function
which starts running asynchronously in the background. This function makes periodic
requests to the server (what they call "hartbeat" above), and this prevents the timeout at
the server side.
But this function should only be running as long as the InetSoft application page is
displayed in the browser.
Once you navigate away (unless you do this in another instance of IE), that page is no
longer loaded, and the javascript heartbeat function could not be running anymore.
So it looks like there is something still unexplained here.
I'm just wondering about this by pure curiosity, because it does not seem to have anything
to do with Tomcat per se whatsoever.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
Official response from InetSoft:
************************************************************************
**********
If you request for a report and leave it running in the browser in
v10.2, the report will send a heartbeat beacon to the report server to
let the server know that the report is still active, which will
effectively keep the user session active.
In v10.3, this has been enhanced so that the timeout value of the report
will be taken into consideration, along with the heartbeat beacon
mechanism instead of having the report be considered active if it is
left open in the browser.
************************************************************************
**********
So, apparently, this is InetSoft's programming causing this, not a
Tomcat bug and the settings are correct. Guess I just need to wait till
10.3... *sigh*.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Debbie Shapiro
Sent: Tuesday, September 14, 2010 4:17 PM
To: 'Tomcat Users List'
Subject: RE: session-timeout not taking effect
waited an extra long time to test out the web page again, but it's still
not timing out. I've asked InetSoft about the heartbeat requests. I'll
update you all with what they say.
Thanks! :-)
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Debbie Shapiro
Sent: Tuesday, September 14, 2010 3:24 PM
To: Tomcat Users List
Subject: RE: session-timeout not taking effect
I tested out navigating to another web page in a different window and
coming back to the web app page after it should have timed out, but no
go.
I just removed the comments for the access log as you mentioned below.
What I'm seeing in the access log are heartbeat requests? Like follows.
I'm not touching the page and I did navigate to another page after I ran
the report...
10.5.2.18 - - [14/Sep/2010:15:22:03 -0700] "POST
/sree/Reports?op=heartbeat&ID=RA_QA[2f]PST[20]Complaints.12845027269201@
local&&isAJAXRequest=true&isContainer=false&isXML=false HTTP/1.1" 200 -
I don't know if this is because we're using LDAP for our security and
InetSoft is checking this constantly. I have a feeling that's what it is
though. :-(
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 2:48 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On Tue, Sep 14, 2010 at 11:39 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I should add that I am neither a Java nor a Tomcat expert by any
means.
> Where would I find some of these settings?
hmm may be a bit tricky
>
> I'm using IE to access this application.
>
> Where would one enable the access log? I essentially have the entire
> Tomcat installation using the defaults at installation, with the
> exception that I have included the InetSoft application directory in
the
> webapps folder.
Is a valve usually on server.xml If you reciently downloaded tomcat
and haven't played with these files there a commented out access log
valve which you can uncomment
( i.e. remove <!-- and its end --> )
> If I navigate to another website and immediately navigate back to the
> InetSoft page, it first displays a page that the login has expired and
> then prompts me to login again.
I don't suppose you know if its using urlRewriting to keep sessions.
There may be something in the browser address bar that says
jsessionid.
>It's only if I leave the page up that it
> seems to not expire. My version of IE doesn't have tabs (I'm still on
> 6.0), so it's either change the current window to a new page or open a
> new window.
Thats fine for the test. Change the current window by navigating to
another site and back (You said before it asks you for a login). I'd
advise a better browser however.
> I'm not sure how to determine that the session-timeout is anything
other
> than 30 minutes aside from looking at the web.xml file. Not familiar
> with JConsole. I don't currently have the Tomcat manager running. I
just
> found the documentation concerning that part of the app and I will see
> about getting that started. As I said, I have everything set to the
> defaults...
>
>
Sorry for the stupid question but when you said the session should be
expired, I assume you don't mean the report shouldn't still be on the
screen.
Is this a public website where someone could test?
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Debbie Shapiro [mailto:DShapiro@cardiacscience.com]
> Subject: RE: session-timeout not taking effect
> What I'm seeing in the access log are heartbeat requests?
Yup - so it's InetSoft's code running *in the browser* that's keeping the session alive.
> I'm not touching the page and I did navigate to another
> page after I ran the report...
That doesn't seem possible... if you navigate away from the page, whatever InetSoft is doing from within the browser should stop. Either there's a bug in IE6, or InetSoft has actually installed something on your client machine that's talking in the background.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
I tested out navigating to another web page in a different window and
coming back to the web app page after it should have timed out, but no
go.
I just removed the comments for the access log as you mentioned below.
What I'm seeing in the access log are heartbeat requests? Like follows.
I'm not touching the page and I did navigate to another page after I ran
the report...
10.5.2.18 - - [14/Sep/2010:15:22:03 -0700] "POST
/sree/Reports?op=heartbeat&ID=RA_QA[2f]PST[20]Complaints.12845027269201@
local&&isAJAXRequest=true&isContainer=false&isXML=false HTTP/1.1" 200 -
I don't know if this is because we're using LDAP for our security and
InetSoft is checking this constantly. I have a feeling that's what it is
though. :-(
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 2:48 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On Tue, Sep 14, 2010 at 11:39 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I should add that I am neither a Java nor a Tomcat expert by any
means.
> Where would I find some of these settings?
hmm may be a bit tricky
>
> I'm using IE to access this application.
>
> Where would one enable the access log? I essentially have the entire
> Tomcat installation using the defaults at installation, with the
> exception that I have included the InetSoft application directory in
the
> webapps folder.
Is a valve usually on server.xml If you reciently downloaded tomcat
and haven't played with these files there a commented out access log
valve which you can uncomment
( i.e. remove <!-- and its end --> )
> If I navigate to another website and immediately navigate back to the
> InetSoft page, it first displays a page that the login has expired and
> then prompts me to login again.
I don't suppose you know if its using urlRewriting to keep sessions.
There may be something in the browser address bar that says
jsessionid.
>It's only if I leave the page up that it
> seems to not expire. My version of IE doesn't have tabs (I'm still on
> 6.0), so it's either change the current window to a new page or open a
> new window.
Thats fine for the test. Change the current window by navigating to
another site and back (You said before it asks you for a login). I'd
advise a better browser however.
> I'm not sure how to determine that the session-timeout is anything
other
> than 30 minutes aside from looking at the web.xml file. Not familiar
> with JConsole. I don't currently have the Tomcat manager running. I
just
> found the documentation concerning that part of the app and I will see
> about getting that started. As I said, I have everything set to the
> defaults...
>
>
Sorry for the stupid question but when you said the session should be
expired, I assume you don't mean the report shouldn't still be on the
screen.
Is this a public website where someone could test?
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
waited an extra long time to test out the web page again, but it's still
not timing out. I've asked InetSoft about the heartbeat requests. I'll
update you all with what they say.
Thanks! :-)
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Debbie Shapiro
Sent: Tuesday, September 14, 2010 3:24 PM
To: Tomcat Users List
Subject: RE: session-timeout not taking effect
I tested out navigating to another web page in a different window and
coming back to the web app page after it should have timed out, but no
go.
I just removed the comments for the access log as you mentioned below.
What I'm seeing in the access log are heartbeat requests? Like follows.
I'm not touching the page and I did navigate to another page after I ran
the report...
10.5.2.18 - - [14/Sep/2010:15:22:03 -0700] "POST
/sree/Reports?op=heartbeat&ID=RA_QA[2f]PST[20]Complaints.12845027269201@
local&&isAJAXRequest=true&isContainer=false&isXML=false HTTP/1.1" 200 -
I don't know if this is because we're using LDAP for our security and
InetSoft is checking this constantly. I have a feeling that's what it is
though. :-(
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 2:48 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On Tue, Sep 14, 2010 at 11:39 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I should add that I am neither a Java nor a Tomcat expert by any
means.
> Where would I find some of these settings?
hmm may be a bit tricky
>
> I'm using IE to access this application.
>
> Where would one enable the access log? I essentially have the entire
> Tomcat installation using the defaults at installation, with the
> exception that I have included the InetSoft application directory in
the
> webapps folder.
Is a valve usually on server.xml If you reciently downloaded tomcat
and haven't played with these files there a commented out access log
valve which you can uncomment
( i.e. remove <!-- and its end --> )
> If I navigate to another website and immediately navigate back to the
> InetSoft page, it first displays a page that the login has expired and
> then prompts me to login again.
I don't suppose you know if its using urlRewriting to keep sessions.
There may be something in the browser address bar that says
jsessionid.
>It's only if I leave the page up that it
> seems to not expire. My version of IE doesn't have tabs (I'm still on
> 6.0), so it's either change the current window to a new page or open a
> new window.
Thats fine for the test. Change the current window by navigating to
another site and back (You said before it asks you for a login). I'd
advise a better browser however.
> I'm not sure how to determine that the session-timeout is anything
other
> than 30 minutes aside from looking at the web.xml file. Not familiar
> with JConsole. I don't currently have the Tomcat manager running. I
just
> found the documentation concerning that part of the app and I will see
> about getting that started. As I said, I have everything set to the
> defaults...
>
>
Sorry for the stupid question but when you said the session should be
expired, I assume you don't mean the report shouldn't still be on the
screen.
Is this a public website where someone could test?
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Debbie Shapiro [mailto:DShapiro@cardiacscience.com]
> Subject: RE: session-timeout not taking effect
> I don't see any setting for session-timeout in the
> WEB-INF/web.xml, only in the conf/web.xml.
Not unusual.
> I haven't configured the manager piece at all yet with
> user id's, etc...
Don't forget to remove the XML comment markers from around the users list.
> As far as I can tell, I'm using version 7.0.0.
You should definitely move up to 7.0.2 (and 7.0.3 as soon as Mark T releases it); lots of things fixed.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
I don't see any setting for session-timeout in the WEB-INF/web.xml, only
in the conf/web.xml.
I haven't configured the manager piece at all yet with user id's, etc...
As far as I can tell, I'm using version 7.0.0.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
Sent: Tuesday, September 14, 2010 3:11 PM
To: Tomcat Users List
Subject: RE: session-timeout not taking effect
> From: Debbie Shapiro [mailto:DShapiro@cardiacscience.com]
> Subject: RE: session-timeout not taking effect
> I'm not sure how to determine that the session-timeout
> is anything other than 30 minutes aside from looking at
> the web.xml file.
Note that there are _two_ web.xml files of interest: the global one in
conf/web.xml, and one specific to the webapp in its WEB-INF/web.xml.
Settings in the latter will override the former.
> Not familiar with JConsole.
An interesting tool for diagnosing JVM behavioral issues, but probably
not for this exercise.
> I don't currently have the Tomcat manager running.
Unless you explicitly removed it, it's running. You may not have access
to the manager, unless you updated conf/tomcat-users.xml with a userid
and password of your choice for the manager-gui role.
BTW, exactly which version of Tomcat 7 are you using?
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
Unfortunately, I can't outsource this. :-( Trying to learn as I go...
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 2:51 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
I'm guessing the only reason you run tomcat is to run this single
application. It may be wise just to get a hosting company to do this
for you they'll know a lot more about the security and configuration
of the environment.
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Wesley Acheson <we...@gmail.com>.
On Tue, Sep 14, 2010 at 11:39 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I should add that I am neither a Java nor a Tomcat expert by any means.
> Where would I find some of these settings?
hmm may be a bit tricky
>
> I'm using IE to access this application.
>
> Where would one enable the access log? I essentially have the entire
> Tomcat installation using the defaults at installation, with the
> exception that I have included the InetSoft application directory in the
> webapps folder.
Is a valve usually on server.xml If you reciently downloaded tomcat
and haven't played with these files there a commented out access log
valve which you can uncomment
( i.e. remove <!-- and its end --> )
> If I navigate to another website and immediately navigate back to the
> InetSoft page, it first displays a page that the login has expired and
> then prompts me to login again.
I don't suppose you know if its using urlRewriting to keep sessions.
There may be something in the browser address bar that says
jsessionid.
>It's only if I leave the page up that it
> seems to not expire. My version of IE doesn't have tabs (I'm still on
> 6.0), so it's either change the current window to a new page or open a
> new window.
Thats fine for the test. Change the current window by navigating to
another site and back (You said before it asks you for a login). I'd
advise a better browser however.
> I'm not sure how to determine that the session-timeout is anything other
> than 30 minutes aside from looking at the web.xml file. Not familiar
> with JConsole. I don't currently have the Tomcat manager running. I just
> found the documentation concerning that part of the app and I will see
> about getting that started. As I said, I have everything set to the
> defaults...
>
>
Sorry for the stupid question but when you said the session should be
expired, I assume you don't mean the report shouldn't still be on the
screen.
Is this a public website where someone could test?
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
I don't see any settings like this in the web.xml located w/in the inetsoft web app directory.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: André Warnier [mailto:aw@ice-sa.com]
Sent: Tuesday, September 14, 2010 3:59 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
Debbie Shapiro wrote:
> You guys are so awesome! And extremely helpful! :-)
>
Oh wow then, I want to be in this group too..
One question which does not appear to have been asked, is *which* session is or is not
timed out. I mean that this is happening with a specific application's page. The
application's idea of a session may be totally different from Tomcat's idea of a session.
For example, if you look at the application's "web.xml" file (in
../webapps/InetSoft/WEB-INF/web.xml), is there a section like <security-constraint>,
<login-config> or similar ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> You guys are so awesome! And extremely helpful! :-)
>
Oh wow then, I want to be in this group too..
One question which does not appear to have been asked, is *which* session is or is not
timed out. I mean that this is happening with a specific application's page. The
application's idea of a session may be totally different from Tomcat's idea of a session.
For example, if you look at the application's "web.xml" file (in
../webapps/InetSoft/WEB-INF/web.xml), is there a section like <security-constraint>,
<login-config> or similar ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
You guys are so awesome! And extremely helpful! :-)
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Pid [mailto:pid@pidster.com]
Sent: Tuesday, September 14, 2010 3:00 PM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On 14/09/2010 22:50, Wesley Acheson wrote:
> I'm guessing the only reason you run tomcat is to run this single
> application. It may be wise just to get a hosting company to do this
> for you they'll know a lot more about the security and configuration
> of the environment.
Nah, we can probably fix it & help the OP to learn a few things for next
time. :)
p
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Pid <pi...@pidster.com>.
On 14/09/2010 22:50, Wesley Acheson wrote:
> I'm guessing the only reason you run tomcat is to run this single
> application. It may be wise just to get a hosting company to do this
> for you they'll know a lot more about the security and configuration
> of the environment.
Nah, we can probably fix it & help the OP to learn a few things for next
time. :)
p
Re: session-timeout not taking effect
Posted by Wesley Acheson <we...@gmail.com>.
I'm guessing the only reason you run tomcat is to run this single
application. It may be wise just to get a hosting company to do this
for you they'll know a lot more about the security and configuration
of the environment.
Wes
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Debbie Shapiro [mailto:DShapiro@cardiacscience.com]
> Subject: RE: session-timeout not taking effect
> I'm not sure how to determine that the session-timeout
> is anything other than 30 minutes aside from looking at
> the web.xml file.
Note that there are _two_ web.xml files of interest: the global one in conf/web.xml, and one specific to the webapp in its WEB-INF/web.xml. Settings in the latter will override the former.
> Not familiar with JConsole.
An interesting tool for diagnosing JVM behavioral issues, but probably not for this exercise.
> I don't currently have the Tomcat manager running.
Unless you explicitly removed it, it's running. You may not have access to the manager, unless you updated conf/tomcat-users.xml with a userid and password of your choice for the manager-gui role.
BTW, exactly which version of Tomcat 7 are you using?
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
I should add that I am neither a Java nor a Tomcat expert by any means.
Where would I find some of these settings?
I'm using IE to access this application.
Where would one enable the access log? I essentially have the entire
Tomcat installation using the defaults at installation, with the
exception that I have included the InetSoft application directory in the
webapps folder.
If I navigate to another website and immediately navigate back to the
InetSoft page, it first displays a page that the login has expired and
then prompts me to login again. It's only if I leave the page up that it
seems to not expire. My version of IE doesn't have tabs (I'm still on
6.0), so it's either change the current window to a new page or open a
new window.
I'm not sure how to determine that the session-timeout is anything other
than 30 minutes aside from looking at the web.xml file. Not familiar
with JConsole. I don't currently have the Tomcat manager running. I just
found the documentation concerning that part of the app and I will see
about getting that started. As I said, I have everything set to the
defaults...
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 10:41 AM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On Tue, Sep 14, 2010 at 7:17 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> Hi Wesley -
> I logged in to my web app, ran a report and then left it alone for 45
> minutes. Came back and tried to run another report. I was expecting to
> receive a prompt to login again, but instead it runs the second
report.
> I also have a case open with InetSoft on this, but they are pointing
me
> to my Tomcat configuration.
>
>
>
>
>
>
> Debbie Shapiro, Data Warehouse Manager
> Office: 425.402.2233
>
> -----Original Message-----
> From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
> Sent: Tuesday, September 14, 2010 9:48 AM
> To: Tomcat Users List
> Subject: Re: session-timeout not taking effect
>
>
> On Tue, Sep 14, 2010 at 6:29 PM, Debbie Shapiro
> <DS...@cardiacscience.com> wrote:
>> I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using
> the
>> default settings for the web.xml file for session-timeout (30
> minutes),
>> but for some reason, the sessions aren't timing out at this point for
>> users of the web app. Is there some reason why this setting would be
>> ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
>> implementation.
>>
>>
>
> Session timeout is the time out for the session if no requests are
> received from the client. What are the symptoms?
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Hi Debbie,
I wasn't saying that that was the problem exactly. There are a number
of things you can do to check, just to rule it out.
1 . If you use firefox try the firebug plugin. Go to the net tab and
run your test. Ensure no more requests are sent.
2. Enable the access log in tomcat. Ensure your requests aren't coming
in more frequently than 1/2 an hour.
3. Run the test again but when you get the report. Navigate to another
website. Leave it the half hour navigate back to the tomcat instance,
check if your still logged in (Don't close the browser window for this
test to be valid)
4. Ensure you aren't seeing cached versions of the pages.
5. Check if the session timeout is indeed set to half an hour. (Maybe
this info is in jconsole I'm sure others on this list will know)
If all this fails then it looks like you have a bug in tomcat on your
hands. Test 1 2 and 3 aren't exclusive they all test the same thing.
Take your pick. (personally I prefer 1 & 2)
Regards,
Wesley
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
> Subject: Re: session-timeout not taking effect
> Check if the session timeout is indeed set to half an hour. (Maybe
> this info is in jconsole I'm sure others on this list will know)
Might be easier to look at the sessions with Tomcat's manager webapp than digging it out of the MBeans with JConsole.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Wesley Acheson <we...@gmail.com>.
On Tue, Sep 14, 2010 at 7:17 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> Hi Wesley -
> I logged in to my web app, ran a report and then left it alone for 45
> minutes. Came back and tried to run another report. I was expecting to
> receive a prompt to login again, but instead it runs the second report.
> I also have a case open with InetSoft on this, but they are pointing me
> to my Tomcat configuration.
>
>
>
>
>
>
> Debbie Shapiro, Data Warehouse Manager
> Office: 425.402.2233
>
> -----Original Message-----
> From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
> Sent: Tuesday, September 14, 2010 9:48 AM
> To: Tomcat Users List
> Subject: Re: session-timeout not taking effect
>
>
> On Tue, Sep 14, 2010 at 6:29 PM, Debbie Shapiro
> <DS...@cardiacscience.com> wrote:
>> I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using
> the
>> default settings for the web.xml file for session-timeout (30
> minutes),
>> but for some reason, the sessions aren't timing out at this point for
>> users of the web app. Is there some reason why this setting would be
>> ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
>> implementation.
>>
>>
>
> Session timeout is the time out for the session if no requests are
> received from the client. What are the symptoms?
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Hi Debbie,
I wasn't saying that that was the problem exactly. There are a number
of things you can do to check, just to rule it out.
1 . If you use firefox try the firebug plugin. Go to the net tab and
run your test. Ensure no more requests are sent.
2. Enable the access log in tomcat. Ensure your requests aren't coming
in more frequently than 1/2 an hour.
3. Run the test again but when you get the report. Navigate to another
website. Leave it the half hour navigate back to the tomcat instance,
check if your still logged in (Don't close the browser window for this
test to be valid)
4. Ensure you aren't seeing cached versions of the pages.
5. Check if the session timeout is indeed set to half an hour. (Maybe
this info is in jconsole I'm sure others on this list will know)
If all this fails then it looks like you have a bug in tomcat on your
hands. Test 1 2 and 3 aren't exclusive they all test the same thing.
Take your pick. (personally I prefer 1 & 2)
Regards,
Wesley
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
André,
On 9/14/2010 6:27 PM, André Warnier wrote:
> Debbie Shapiro wrote:
>> Hi Wesley -
>> I logged in to my web app, ran a report and then left it alone for 45
>> minutes. Came back and tried to run another report. I was expecting to
>> receive a prompt to login again, but instead it runs the second report.
>> I also have a case open with InetSoft on this, but they are pointing me
>> to my Tomcat configuration.
>>
> A question to the developers maybe : does the timeout attribute mean
> that the server /must/ time out the session after that period of
> inactivity, or just that it /may/ time it out ? (such as for example if
> it needs to, because it needs the space)
See the spec (r2.5 in this case) SRV.7.5 "Session Timeouts":
"
In the HTTP protocol, there is no explicit termination signal when a
client is no longer active. This means that the only mechanism that can
be used to indicate when a client is no longer active is a timeout period.
...
Once the session invalidation is initiated, a new request must not
be able to see that session.
"
So, the spec defines the default inactive timeout, indicates that the
server should (but does not exactly say MUST/SHALL, though it's pretty
clear that enforcement is not optional) expire timed-out sessions and
that, once timed-out, they are no longer allowed to be used.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyQ124ACgkQ9CaO5/Lv0PBsUwCfTwV0sMfcYjThZu/sY29B3m9q
sYkAnRE8wjR97tqESEcxTSLZWsloo0V/
=T6Qg
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Mark Thomas <ma...@apache.org>.
On 14/09/2010 23:27, André Warnier wrote:
> Debbie Shapiro wrote:
>> Hi Wesley -
>> I logged in to my web app, ran a report and then left it alone for 45
>> minutes. Came back and tried to run another report. I was expecting to
>> receive a prompt to login again, but instead it runs the second report.
>> I also have a case open with InetSoft on this, but they are pointing me
>> to my Tomcat configuration.
>>
> A question to the developers maybe : does the timeout attribute mean
> that the server /must/ time out the session after that period of
> inactivity, or just that it /may/ time it out ? (such as for example if
> it needs to, because it needs the space)
Sessions are checked for expiration every time the container background
thread runs which is every 15 seconds by default. A session that has
expired will time out.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by André Warnier <aw...@ice-sa.com>.
Debbie Shapiro wrote:
> Hi Wesley -
> I logged in to my web app, ran a report and then left it alone for 45
> minutes. Came back and tried to run another report. I was expecting to
> receive a prompt to login again, but instead it runs the second report.
> I also have a case open with InetSoft on this, but they are pointing me
> to my Tomcat configuration.
>
A question to the developers maybe : does the timeout attribute mean that the server
/must/ time out the session after that period of inactivity, or just that it /may/ time it
out ? (such as for example if it needs to, because it needs the space)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: session-timeout not taking effect
Posted by Debbie Shapiro <DS...@cardiacscience.com>.
Hi Wesley -
I logged in to my web app, ran a report and then left it alone for 45
minutes. Came back and tried to run another report. I was expecting to
receive a prompt to login again, but instead it runs the second report.
I also have a case open with InetSoft on this, but they are pointing me
to my Tomcat configuration.
Debbie Shapiro, Data Warehouse Manager
Office: 425.402.2233
-----Original Message-----
From: Wesley Acheson [mailto:wesley.acheson@gmail.com]
Sent: Tuesday, September 14, 2010 9:48 AM
To: Tomcat Users List
Subject: Re: session-timeout not taking effect
On Tue, Sep 14, 2010 at 6:29 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using
the
> default settings for the web.xml file for session-timeout (30
minutes),
> but for some reason, the sessions aren't timing out at this point for
> users of the web app. Is there some reason why this setting would be
> ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
> implementation.
>
>
Session timeout is the time out for the session if no requests are
received from the client. What are the symptoms?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: session-timeout not taking effect
Posted by Wesley Acheson <we...@gmail.com>.
On Tue, Sep 14, 2010 at 6:29 PM, Debbie Shapiro
<DS...@cardiacscience.com> wrote:
> I am using Tomcat 7.0 on a Windows 2003 Server 64-bit OS. I'm using the
> default settings for the web.xml file for session-timeout (30 minutes),
> but for some reason, the sessions aren't timing out at this point for
> users of the web app. Is there some reason why this setting would be
> ignored? I'm using Tomcat 7.0 with an InetSoft business intelligence
> implementation.
>
>
Session timeout is the time out for the session if no requests are
received from the client. What are the symptoms?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org