Tomcat 中带有过期日期的 JSESSIONID Cookie
为 Tomcat 为 servlet 会话发送的 JSESSIONID cookie 设置过期日期的最佳方法是什么？
默认情况下，cookie的过期日期似乎是“session”，这意味着一旦浏览器重新启动，会话就会在客户端消失。但我想保持它打开 12 小时，即使在浏览器重新启动后也是如此（然后相应地在服务器中配置会话超时）。
有没有办法在 Tomcat 中设置到期日期，例如使用某些配置选项或扩展模块？或者是否有可靠的方法使用 Servlet 过滤器设置 JSESSIONID 的到期日期？
What's the best way to set an expiration date for the JSESSIONID cookie sent by Tomcat for a servlet session?
By default, the expiration date of the cookie seems to be 'session', which means that the session disappears in the client as soon as the browser restarts. But I would like to keep it open for 12h, even after a browser restart (and would then configure the session timeout in the server accordingly).
Is there any way to set an expiration date within Tomcat, e.g. using some configuration option or extension module? Or is there a reliable way to set an expiration date for JSESSIONID using a Servlet filter?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
从 Servlet 3.0 开始，可以简单地在 web.xml 中指定：
请注意，
session-timeout以分钟为单位，而max-age以秒为单位。As of Servlet 3.0, this can simply be specified in the web.xml:
Note that
session-timeoutis measured in minutes butmax-ageis measured in seconds.我认为在不更改 Tomcat 代码的情况下不可能做你想做的事。
但请注意，它可能会产生令人讨厌的副作用：如果用户启动会话并保持活动状态十二个小时，其会话超时将相应更新（超时将在每次请求时更新），但其 cookie 不会，并且因此，用户将在 12 小时后失去会话，即使他一直处于活动状态。
I don't think it's possible to do what you want, without changing the Tomcat code.
Note however that it might have a nasty side effect : if a user starts a session and stays active for twelve hours, its session timeout will be updated accordingly (the timeout will be updated at each request), but its cookie won't, and the user will thus lose its session after 12 hours, even if he's been active all this time.