For our application, we don't want to set the session timeout in the web.xml file. We want to support the following, using the HttpSession.setMaxInactiveInterval method:

1) when a user is not logged into our system (ie, displaying the login page), we're defining a default timeout period of 30 minutes (a value of 1800 into the setMaxInactiveInternal method)
2) once a user has successfully logged into our web application, we want to define it to a custom value, or if none defined default to an indefinate period

So, once the user successfully logs in, our application checks for a local setting. If none is provided, the application will default to indefinite timeouts by passing a -1 to the setMaxInactiveInternal method for the HttpSession.

However, the value never stays set to -1. It is always being set back to 1800. If a positive value is defined, then it does not get set back to 1800