Session Invalidation in WebSphere

HTTP Sessions are invalidated one of two ways:

•      The application calls the invalidate() method on the session object.
•     The session is not accessed for a period that is longer than the specified session timeout

            (MaxInactiveInterval) in the WebSphere® Application Server session manager.

 

How does the WebSphere Application Server session manager invalidate sessions?

•     A session is eligible for invalidation if it has not been accessed for a period that is longer than the specified session timeout (MaxInactiveInterval) . The session manager has an invalidation process thread that runs every X seconds to invalidate sessions that are eligible for invalidation.
•       The session manager uses a formula to determine the value of X. The value of X is calculated based on MaxInactiveInterval specified in the session manager and is referred to as the ReaperInterval.
•      if maximum inactive interval of <15 minutes, the ReaperInterval (value of X) is approximately 60 to 90 seconds and if the a maximum inactive interval of >15 minutes the ReaperInterval (value of X) is approximately 300 to 360 seconds.
•       As a result, a session might not be invalidated for MaxInactiveInterval + ReaperInterval seconds .            

Can the Reaper Interval be controlled?

You can specify custom value for Reaper Interval using a Java™ virtual machine (JVM™) system property.

For WebSphere Application Server V3.5.6 or higher and V4.0.2 or higher:

-DSessionReaperInterval= (in seconds)

For all releases of WebSphere Application Server V5.0:

                       -DHttpSessionReaperPollInterval= (in seconds)

•       Sessions are eligible for invalidation as soon as their maximum inactive interval expires, but are not actually invalidated until the reaper runs, which might be up to 6 minutes later. You can use this property to force the reaper to run more often, like every 60 seconds.

•       Note that the more often the reaper runs, the more overhead it takes, so it can negatively impact performance. Values less than 60 seconds are not recommended.