Lifetime of session in Apache Tomcat

Session timeout hierarchy:

• $tomcat_home/conf/web.xml 
• $your_webapp/WEB-INF/web.xml 
• manual invocation of HttpSession.setMaxInactiveInterval(int) 

<session-config>
    <session-timeout>5</session-timeout>
</session-config>

Each subsequent entry overrides others above.

Source