title: How to determine Java Servlet / Spring session timeout and good practise
body: <p>I noticed that the jsessionId will get sent across to the server so in the filter I could actually get the expired session id from the cookies.</p>
  
  <p>Is it ok to put a filter logic like the following?</p>
  
  <pre><code>Cookie jsessionCookie = getSessionIdCookies(request);
  Session session = request.getSession(false);
  if (session == null || !(jsessionCookie.getValue().equals(session.getId())) {
      //this should be a timeout handling
      ....
  } else {
      // normal moving forward
  }
  </code></pre>
  
  <p>Since the <code>session == null</code> could also because of a new request (which can be filtered out by setting particular filter rules), can I more rely on <code>!(jsessionCookie.getValue().equals(session.getId())</code>?</p>
  
  <p>Or even change the <code>request.getSession(false)</code> to  <code>request.getSession()</code> and just always compare the cookie with the session id?</p>
  
  <p>Is there a better management practice for session timeout management?</p>