Possible bug as mentioned in https://developer.jboss.org/thread/278634. As mentioned in the thread, use of bumpTimeout may cause a session that may never expire.

From jstourac@redhat.com:

The list of methods where 'bumpTimeout' is actually used in InMemorySessionManager to following: createSession(), setMaxInactiveInterval(), getAttribute(), getAttributeNames(), setAttribute(), removeAttribute(). From this list usage in following methods is suspicious: getAttribute(), getAttributeNames(), setAttribute(), removeAttribute().

All occurrences were added by this commit with initial session timeout implementation.

The truth is the Servlet 4.0, section 7.5 specification (Servlet 3.1 is almost identical) specifies that timeout depends on user activity only:

"This means that the only mechanism that can be used to indicate when a client is no longer active is a time out period."

Response from stuartdouglas_jira from mail:

We could probably change that to just update the timeout in requestDone().