The HttpSession timeout in JBoss can be set at three different levels:

To change default timeout value for every web application:

Edit the Web Deployer's default wed application configuration:

JBoss 5

Edit deployers/jbossweb.deployer/web.xml

JBoss 4.3

Earlier versions

Edit deploy/jbossweb-tomcat55.sar/conf/web.xml

   <!-- ==================== Default Session Configuration ================= -->
   <!-- You can set the default session timeout (in minutes) for all newly   -->
   <!-- created sessions by modifying the value below.                       -->

   <session-config>
      <session-timeout>30</session-timeout>
   </session-config>

To override the default HttpSession timeout on a per-webapp basis:

Add the same tags as above to WEB-INF/web.xml.  Here is the DTD for further explanation:

<!--
The session-config element defines the session parameters for
this web application.

Used in: web-app
-->
<!ELEMENT session-config (session-timeout?)>

<!--
The session-timeout element defines the default session timeout
interval for all sessions created in this web application. The
specified timeout must be expressed in a whole number of minutes.
If the timeout is 0 or less, the container ensures the default
behaviour of sessions is never to time out.

Used in: session-config
-->
<!ELEMENT session-timeout (#PCDATA)>

To override the global and web app value for a single client, call HttpSession.setMaxInactiveInterval(int seconds)

Referenced by: