Session Timeout Setting Does Not Take Effect

Issue

After configuring the session timeout in the portal-ext.properties and web.xml files, the session still expires sooner than the configured value. For example, the session expires after 15 minutes, even when it is set to 240 minutes.

Environment

• Quarterly Releases

Resolution

One reason for the occurrence of this issue, is that the incorrect web.xml file is modified. There are two web.xml files in a default Tomcat bundle, and each serves a different purpose:

• [liferay-home]/tomcat/conf/web.xml: This is the global configuration file for the Tomcat server. Settings here apply to all web applications deployed in the instance unless overridden.
• [liferay-home]/tomcat/webapps/ROOT/WEB-INF/web.xml: This is the application-specific configuration file for the Liferay DXP application (the ROOT webapp). Settings here override the global configurations from the conf/web.xml file.

To correctly extend the session timeout, follow these steps:

1. Open the Liferay-specific web.xml file located at:

   [liferay-home]/tomcat/webapps/ROOT/WEB-INF/web.xml

2. Modify the <session-timeout> value. The value is in minutes.

   <session-config>
       <session-timeout>240</session-timeout>
   </session-config>

3. In your portal-ext.properties file, ensure the session.timeout property is also set to the same value (in minutes):

   session.timeout=240

4. Restart the Liferay DXP server for the changes to take effect.
5. Clear your browser's cache and cookies before testing the new session timeout.

Additional Information

• If you have a load balancer or a web server (e.g., Apache, Nginx) in front of Liferay, ensure that its own session timeout settings are configured to be greater than or equal to the Liferay session timeout. Otherwise, the external system may terminate the session prematurely.