There are several cases when a session is invalidated:
1. when the time specified in web.xml elapsed (session-timeout tag) - this is specified for the entire server
2. when using session.setMaxInactiveInterval. specs:
"Specifies the time, in seconds, between client requests before the servlet container will invalidate this session."
3. when you call session.invalidate() specs: " Invalidates this session then unbinds any objects bound to it." With this, the session is immediately invalidated.