Christophe,

I'm a real novice, so I can only hope this helps.

The session configuration is described in the "web application
deployment descriptor file" (named web.xml).  The <session-config>
element configures session tracking for a web application.  Within
that, the <session-timeout> element contains the default session
timeout for the described web application.  The default is to never
timeout.  Values are integers that specify whole minutes.

I don't know of a way to override that descriptor from within the web
application itself, but I'm only a novice. Someone can help us by
calling me a stupid jerk and (maybe) gently describing how to do this.

--jondr

here is part of a web.xml file showing this:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
        version="2.4">
.......
   <session-config>
       <session-timeout>
           30
       </session-timeout>
   </session-config>
.......
</web-app>