dcsimg

How close is the actual session timeout period to the specified timeout period?

Created May 4, 2012

Avi Kak

During some development work recently, I became curious as to how close the actual session timeout period was to the specified timeout period. Much to my surprise, I discovered a wide discrepancy between the two for the case when the specified timeout periods are short. I have not done experiments for the case when the specified timeout periods are long. I'd expect that for the case of long timeout periods, the two -- the specified and the actual -- would be in fairly close agreement.

I show below some empirical data obtained for four different values of the specified timeout periods: 10, 20, 60, and 120 seconds. For each case, I ran five trials. Each trial consisted of hitting the reload button of the client browser after the session had already timed out from the previous reload.
all times are in seconds
Specified session timeout period Actual session timeout period for the server running on a Windows NT machine Actual session timeout period for the server running on a Solaris 5.6 machine
10 24 32
  53 53
  53 47
  44 48
  45 50
20 54 39
  44 51
  45 40
  25 22
  49 52
60 105 93
  97 114
  100 110
  113 109
  101 110
120 131 161
  170 146
  169 135
  165 137
  147 146
These results were obtained with Tomcat 3.1 as a stand-alone web server for both Windows NT and Solaris. The browser used was Netscape 4.73.

Shown below is a servlet, TestSessionTimeout, that I used for measuring the actual session timeout periods. For those new to servlets, the following comments should prove useful for understanding this servlet:

  • Assuming that a session was not previously created, the method 
    
     HttpSession session =  HttpServletRequest.getSession( true );
    creates a new session between a client and a server. 
    

  • 

   The timeout period of this session can be specified by invoking

    
       session.setMaxInactiveInterval( int interval );


    
   The timeout period of a session is the maximum permissible time in
   seconds between successive client accesses.  If a client request is
   not received within the specified timeout period, the session is
   invalidated and objects bound to it are unbound.

    

  • 

   If an object wishes to receive notification of when it is bound to or
   unbound from a session, the object must implement the
   HttpSessionBindingListener interface.




The servlet shown below uses a SessionTimer class that
implements the HttpSessionBindingListener interface.  When a
session times out, the SessionTimer object, timer, is
notified of that fact.  It then proceeds to calculate the time difference
between the creation time instant of the session and the time when the
session becomes invalidated.




import java.io.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class TestSessionTimeout extends HttpServlet {

  private static final String TIMER_KEY = "session.timer";

  public void doGet (HttpServletRequest request, HttpServletResponse response)
         throws ServletException, IOException 
  {
    HttpSession session = request.getSession(true);
    session.setMaxInactiveInterval( 120 );      
    SessionTimer timer = (SessionTimer) session.getAttribute( TIMER_KEY );

    if ( timer == null ) {
      timer = new SessionTimer( session.getCreationTime() );
      session.setAttribute( TIMER_KEY, timer );
    }

// Generate Output
    response.setContentType("text/html");
    PrintWriter out = response.getWriter();
    out.println("<html>" +
      "<head><title>Session Information</title></head>" +
      "<body bgcolor="#FFFFFF">" +
      "<h1>Session Information</h1><table>");
    out.println ("<tr><td>Identifier</td>");
    out.println ("<td>" + session.getId() + "</td></tr>");
    out.println ("<tr><td>Created</td>");
    out.println ("<td>" + new Date(session.getCreationTime()) + "</td></tr>");
    out.println ("<tr><td>Last Accessed</td>");
    out.println ("<td>" + new Date(session.getLastAccessedTime()) + "</td></tr>");
    out.println ("<tr><td>New Session?</td>");
    out.println ("<td>" + session.isNew() + "</td></tr>");
    Enumeration names = session.getAttributeNames();
    while ( names.hasMoreElements() ) {
      String name = (String) names.nextElement();
      out.println ("<tr><td>" + name + "</td>");
      out.println ("<td>" + session.getAttribute(name) + "</td></tr>");
    }
    out.println("</table></center></body></html>");
    out.close();
  }
}



class SessionTimer implements HttpSessionBindingListener {

  private long createTime;

  public SessionTimer( long ctime ) 
  {
    createTime = ctime;
  }

  public void valueBound( HttpSessionBindingEvent event ) {}

  public void valueUnbound( HttpSessionBindingEvent event ) 
  {
    try {
      long diffTimeInSecs = ( System.currentTimeMillis() - createTime ) / 1000;
      System.out.println( "The session duration in seconds: " + diffTimeInSecs );
    } catch( SecurityException e ) {}
  }
}