Java : Excessive session timeout

Then longer the session, then more opportunities for attacks an adversary has. While the session is active, he/she can bruteforce the password, crack the wireless access point encryption or hijack the session using then open browser.

In addition, long sessions prevent the release of memory, which will ultimately lead to a denial of service if too many sessions are opened at the same time.