Session timeout confusion - session.setMaxInactiveInterval(0)

Question

I am new to JEE and this is what confuses me. According to HttpSession.html#setMaxInactiveInterval(int interval) documentation

An interval value of zero or less indicates that the session should never timeout.

but according to my text book (which already is few years old - so I expect it not to be always right) using zero as argument should cause session to timeout immediately.

This code

public class Test extends HttpServlet {

    protected void doGet(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {

        response.setContentType("text/html");
        response.setCharacterEncoding("utf-8");

        PrintWriter out = response.getWriter();

        HttpSession session = request.getSession();
        session.setAttribute("foo", 42);
        session.setMaxInactiveInterval(0);

        out.println(session.getAttribute("foo"));//problem here

    }
}

used on Glassfish 4.0 seems to confirm theory from textbook instead of newer official documentation because it returns HTTP Status 500 - Internal Server Error with error message

java.lang.IllegalStateException: getAttribute: Session already invalidated

What is going on here? Is this Glassfish 4.0 bug or documentation is wrong? Or maybe there is third option?

---

PS. This code works as it should with negative values (session is not invalidated) and I am using -1 instead of 0 in my code. I am just interested what is wrong with 0.

Answer 1

The Servlet Specification chapter on Session Timeouts states

By definition, if the time out period for a session is set to -1, the session will never expire.

So GlasshFish seems to have that covered. I can't find any reference in the specification that says that the same should be true for a value of 0 with setMaxInactiveInterval(). However it does say

The session-config defines the session parameters for this Web application. The sub-element session-timeout defines the default session time out interval for all sessions created in this Web application. The specified time out must be expressed in a whole number of minutes. If the time out is 0 or less, the container ensures the default behavior of sessions is never to time out. If this element is not specified, the container must set its default time out period.

Answer 2

This is already time out and invalidate

session.setMaxInactiveInterval(0); // mean inactive immediately

So this is correct error message. (please refer head first book for further reference.)

You are trying to access object value which is not exist. it's already destroyed