If you have a session timeout in rails using the :expire_after in session_store.rb
AppRails3::Application.config.session_store :cookie_store,
key: '_App_Rails3_session',
:expire_after => 20.minutes
and in Tomcat you set session-timeout in the web.xml.
Which one will be used? Both?
The first part will expire the cookie session store.
The tomcat one will take care of the java servlet session store.
So, the answer is both.