How to configure a session timeout for Grails application?

Question

In one of controllers in my Grails application I'm preserving a parameter value in a session variable like this:

session.myVariable = params.myValue

After that, I can access the saved value from different controllers/GSP-pages as long as I actively use the app. However, if I don't use my app for a while, even though my browser window is still open, the session variable looses it's value.

Does this happens because the session expires? I was under impression that a session lives until the browser window is still open, but apparently I was wrong.

What should I do to ensure all session variables I define in my Grails app don't expire until the browser is closed? Is there any way to set session timeout manually?

Thank you in advance for your answers!

Handbill

Answer 1

Another option would be modifying web.xml. Prior you must call

grails install-templates

Then edit src/templates/war/web.xml and add/modify after servlet-mapping:

<session-config>
   <session-timeout>60</session-timeout>
</session-config>

The value of session-timeout uses minutes as unit.

Kaule

Thanks, Stefan! That's EXACTLY what I was looking for. I didn't realize I have to explicitly 'install-templates' to get to web.xml. I'm still a n00b in Grails :) – Handbill

I want to handle a session timeout as well. I just have a question about this. Configuring this in the web.xml file, what would happend once the session expires and an action from a controller is executed? Would the session.myVariable from @curd0's example will return null? Thanks! – Elamite

It this still required for Grails 2.x? I thought web.xml was standard in grails apps; why is install-templates required? – Bialystok

@Bialystok I don't know if it is required, but it does work with grails 2.x (testing grails 2.5.4 here). grails install-templates outputs a lot of stuff but you only have to keep src/templates/war/web.xml, all the rest of src/templates can be deleted. – Monogenic

Answer 2

Fast forward a few years... For Grails 3.0 set the session timeout with ServerProperties in the application configuration file.

grails-app/conf/application.yml

server:
   session:
      timeout: 3600  #seconds

Default value: 1800 seconds (30 minutes)

Verify the timeout for the HttpSession from a controller using getMaxInactiveInterval():

log.println "Timeout: ${session.getMaxInactiveInterval()} seconds"

Output --> Timeout: 3600 seconds

Update 1: Edited for changes to Grails 3.1 configuration.

Update 2: For Grails 5, see comment below by Marc Schmid.

Boadicea

Actually it is now server: session: timeout: 3600 – Cambyses

how to disable session timeout? @DemPilafian – Herd

@akiong, I haven't tried it, but according to the documentation, A zero or negative time indicates that the session should never timeout. – Boadicea

For Grails 5 it is server.servlet.session.timeout=8h. It changed as the property was change in the underlying spring-boot version. See #40975455 – Flux

Answer 3

The current grails (2.x) have a very odd design approach to setting the session timeout. None of the prevailing ideas are great:

1. comment out "//session Timeout" section the within the WebxmlGrails Plugin and add "sessionConfig.sessionTimeout=" to Config.groovy

2. grails install-templates, remove session-timeout from web.xml, add timeout in WebXmlConfig.groovy

3. wait for a fix. :/

A co-worker came up with the following code that works well for me and will do until a real solution is built into grails core.

Simply add the following to the bottom of your config.groovy file and then set the appropriate timeout.

grails.war.resources = { stagingDir, args ->
  def webXML = new java.io.File("${stagingDir}/WEB-INF/web.xml")
  webXML.text = webXML.text.replaceFirst("<session-timeout>30</session-timeout>", "<session-timeout>90</session-timeout>")
}

My I suggest that the correct solution is to allow a single line in the Config.groovy file:

session.timeout = 90;

Cheers.

Taxis

Do you mean "add the following to the bottom of your BuildConfig.groovy" ? – Nonie

Yep, @Nonie is right, BuildConfig is the place where this has an effect. – Repetition

Answer 4

With Grails 3.1.x session-timeout is deprecated. The correct property in application.yml is:

server:
    session.timeout: 7200

Surovy

Answer 5

I could be wrong, but I'm pretty sure Grails uses the sessions associated with your application container. If you're using Tomcat, for example, you can specify the length of a session.

Tutorial for changing Tomcat session length.

Kozloski

Grails does use the container's sessions, but just overriding the default doesn't work because grails will generate a new servlet specific web.xml that will override the default. – Mellins

Answer 6

here is a better working solution. go you your grails home directory and find Example: E:\grails-2.3.8\src\war\WEB-INF\web3.0.template.xml edit the session time out value to desired values:

Example: enter code here 90

Drubbing

Answer 7

For Grails 3 application, modifying the Application.groovy worked for me:

package foo

import grails.boot.GrailsApp
import grails.boot.config.GrailsAutoConfiguration
import org.apache.catalina.Context
import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory
import org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer
import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory
import org.springframework.context.annotation.Bean

class Application extends GrailsAutoConfiguration {

    static void main(String[] args) {
        GrailsApp.run(Application, args)
    }

    @Bean
    EmbeddedServletContainerFactory containerFactory() {
        TomcatEmbeddedServletContainerFactory containerFactory = new TomcatEmbeddedServletContainerFactory()

        containerFactory.addContextCustomizers(new TomcatContextCustomizer() {
            @Override
            void customize(Context context) {
                int oneWeekInMinute = 7 * 24 * 60
                context.setSessionTimeout(oneWeekInMinute)
            }
        });

        return containerFactory
    }

}

Trotman