Ok, just found out how Christian is using variable session lengths in the wiki example application. That is of course one way to limit the impact of the unneeded session pile-up. Will apply that one while looking for other ways to circumvent JSFs (presumably) misuse of the session altogether.

Tobias

Details from the example:

    @Observer("org.jboss.seam.security.loginSuccessful")
    public void extendSessionTime() {
        // Store the regular session timeout value, so we can set it back later on logout
        int regularSessionTimeout = ServletContexts.getInstance().getRequest().getSession().getMaxInactiveInterval();
        Contexts.getSessionContext().set(REGULAR_SESSION_MAX_INACTIVE_SECONDS, regularSessionTimeout);
        WikiInit init = (WikiInit)Component.getInstance(WikiInit.class);
        if (init.getAuthenticatedSessionTimeoutMinutes() != 0) {
            log.debug("setting timeout of authenticated user session to minutes: " + init.getAuthenticatedSessionTimeoutMinutes());
            ServletContexts.getInstance().getRequest().getSession().setMaxInactiveInterval(
                init.getAuthenticatedSessionTimeoutMinutes()*60
            );
        }
    }

    @Observer("org.jboss.seam.security.loggedOut")
    public void resetSessionTime() {
        // Don't rely on that, do a null check - this should never be null but sometimes it is... *sigh*
        Object o = Contexts.getSessionContext().get(REGULAR_SESSION_MAX_INACTIVE_SECONDS);
        if (o != null) {
            int regularSessionTimeout = (Integer) o;
            log.debug("resetting timeout of user session after logout to minutes: " + regularSessionTimeout/60);
            ServletContexts.getInstance().getRequest().getSession().setMaxInactiveInterval(regularSessionTimeout);
        } else {
            // Safety, reset to a low value, 10 minutes
            ServletContexts.getInstance().getRequest().getSession().setMaxInactiveInterval(600);
        }
    }

Yes I saw that issue ... and yes I do believe that it is the very same thing.