[SHIRO-421] Unable to set long timeouts on HttpServletSession

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.1
• Fix Version/s: 1.3.0
• Component/s: Session Management
• Labels: patch patch-with-test session
• Assignee: Unassigned
• Reporter: Andrew Pitman
• Created: 08/Mar/13 19:29
• Updated: 07/Jul/16 14:23
• Resolved: 07/Jul/16 14:23

Description

When I set the timeout on a org.apache.shiro.web.session.HttpServletSession to a large value (30 days == 2592000000 milliseconds) using the setTimeout(long) method and then read the timeout with the getTimeout() method, I get -1702967296. I would like to be able to do this in order to have a long-lasting session for users who select "remember me" when logging in to a web app.

I think this may have something to do with the fact that the getTimeout() method is using integer multiplication before converting the javax.servlet.http.HttpSession's max inactive interval from an int to a long.