Multiple choice technology security

In web.xml value of is defined in

  1. Milliseconds

  2. Seconds

  3. Minutes

  4. Hours
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The element in web.xml specifies session timeout in MINUTES, not smaller time units. This is defined in the servlet specification - the value represents the integer number of minutes before an inactive session is invalidated. Using milliseconds (A) or seconds (B) would make timeouts impractically large, and hours (D) is not the standard unit defined in the spec.

AI explanation

Minutes is correct. In a Java EE web.xml deployment descriptor, the element's value specifies the default session timeout interval for all sessions in that web application, and per the Servlet specification this value is expressed in minutes (e.g., 30 means 30 minutes of inactivity before the session expires). This is a commonly-tested gotcha precisely because most other timeout-related settings in Java web configs (and in HttpSession's programmatic setMaxInactiveInterval method) are expressed in seconds, while web.xml's declarative session-timeout is the odd one out, using minutes.

Keep practicing — related questions