title: Spring Security: set session max inactive interval declaratively?
body: <p>How can I do it with java-config in Spring Boot application with (embedded Tomcat)?
  I expected these settings to be declarative and configurable in WebSecurityConfigurerAdapter, like this:</p>
  
  <pre><code>  @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable()
              .authorizeRequests()
              .antMatchers("/api/*").permitAll()
              .antMatchers("/login*","/signin/**","/signup/**").permitAll()
              .antMatchers("/USER/**").hasAnyRole("USER")
              .formLogin()
              // setSessionMaxInactiveInterval(60*60);
      }
  </code></pre>
  
  <p>But there is no such settings?</p>
  
  <p>The only way I am able do it is to extend the default <a href="https://docs.spring.io/spring-security/site/docs/4.2.6.RELEASE/apidocs/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.html" rel="nofollow noreferrer">SavedRequestAwareAuthenticationSuccessHandler</a> (which behavior is pretty suitable for my app) and add the needed logic there programmatically:</p>
  
  <pre><code>@Slf4j
  @Component
  public class SessionSettingsHandler extends SavedRequestAwareAuthenticationSuccessHandler {
  
      private static final int MAX_INACTIVE_INTERVAL = 60; // sec
  
      @Override
      public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
          super.onAuthenticationSuccess(request, response, authentication);
          request.getSession().setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);
          log.debug("Session inactive interval: {}", MAX_INACTIVE_INTERVAL);
      }
  }
  
  
    @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable()
              .authorizeRequests()
              .antMatchers("/api/*").permitAll()
              .antMatchers("/login*","/signin/**","/signup/**").permitAll()
              .antMatchers("/USER/**").hasAnyRole("USER")
              .formLogin()
              .successHandler(sessionSettingsHandler);
      }
  </code></pre>
  
  <p>This works but I feel like these settings should exist in Spring Boot?</p>
  
  <p>I also tried to set application.properties:
   <em>spring.session.timeout = 3600</em> </p>
  
  <p>But these settings seem to be simply ignored by Spring Security.</p>