Currently the only way to configure a session is by modifying the web.xml file. The major shortcoming of this approach is that the change is transient. Web.xml gets overwritten every time the war file is rebuild or Jira is upgraded. The session timeout value must be configurable via the administrative interface and must be persisted in the database.