title: Timeout set in the web.xml is not working in java
body: <p>I am trying to set my application timeout on Tomcat 7 app server.First I am testing with my timeout as one minute in web.xml as </p>
  
  <pre><code> &lt;session-config&gt;
         &lt;session-timeout&gt;1&lt;/session-timeout&gt;
    &lt;/session-config&gt; 
  </code></pre>
  
  <p>and I am using <a href="http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpSessionListener.html" rel="noreferrer">HttpSessionListener</a> to make sure my Timeout is working fine.I declared my sessionListener Class in web.xml .</p>
  
  <pre><code>public class HttpSessionChecker implements HttpSessionListener {
  
      public void sessionCreated(HttpSessionEvent event) {
          System.out.printf("Session ID %s created at %s%n", event.getSession().getId(), new Date());
      }
      public void sessionDestroyed(HttpSessionEvent event) {
          System.out.printf("Session ID %s destroyed at %s%n", event.getSession().getId(), new Date());
      }
  }
  </code></pre>
  
  <p>and In web.xml</p>
  
  <pre><code>&lt;listener&gt;
      &lt;listener-class&gt;com.test.util.HttpSessionChecker&lt;/listener-class&gt;
  &lt;/listener&gt;
  </code></pre>
  
  <p>But when start my server and launch my application I see session is initiated on the Login page only .</p>
  
  <pre><code>Session ID 934073ED5E9933158995EE5EB680D3F7 created at Wed Nov 07 09:39:13 PST 2012
  </code></pre>
  
  <p>and when I stay Idle for more than a minute or some times more than five minutes cause Tomcat don't fire Timeout immediately in my application and click on something in my application Session is not Expired.Still I am able to navigate another page.But When I am stay Idle on the login page or logged-out I see the session is destroyed. But when once Login is done and when I am inside the application session timeout is not happening. I see</p>
  
  <pre><code>Session ID 934073ED5E9933158995EE5EB680D3F7 destroyed at Wed Nov 07 09:42:13 PST 2012
  </code></pre>
  
  <p>What am I doing wrong? And even after I mentioned <code>&lt;session-timeout&gt;</code> in <code>web.xml</code> do I need code <code>session.invalidate</code>somewhere in Code? How Can I redirect to <code>login.xhtml</code> in session destroyed in JSF?</p>