title: Difference between setting session timeouts using web.xml and setMaxInactiveInterval
body: <p>I have a requirement where a user is authenticated into a session and after 10 minutes of inactivity, the session times out. Once the session times out any further requests from the now expired session is redirected to a timed out page. I have researched in this regard and came to 2 different approaches.</p>
  <p><strong>Approach #1:</strong></p>
  <p>In <code>web.xml</code> I have the code mentioned below...</p>
  <pre><code>&lt;session-config&gt;
       &lt;session-timeout&gt;10&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  </code></pre>
  <p><strong>Approach #2:</strong></p>
  <p>I have the code mentioned below inside the authenticated page...</p>
  <pre><code>response.setHeader(&quot;Cache-Control&quot;, &quot;no-cache, no-store, must-revalidate&quot;); // HTTP 1.1.
  response.setHeader(&quot;Pragma&quot;, &quot;no-cache&quot;); // HTTP 1.0.
  response.setDateHeader(&quot;Expires&quot;, 0); // Proxies.
  
  request.getSession().setMaxInactiveInterval(600);
  </code></pre>
  <p>Now my questions are:</p>
  <p>What is the difference between these two approaches? Which one is better or recommended?</p>
  <p>And also when using approach #2, if the end user navigates away from the authenticated page but has not logged out, does the session still times out after 10 mins of inactivity?</p>