code: public void run() {
          if (maxTime < 0) {
              return;
          }
          long timeMillis = (long)maxTime * 60 * 1000;
          endTime = new Date((new Date()).getTime() + timeMillis);
          while (!cancel && endTime.after(new Date())) {
              try {
                  Thread.sleep(1000);
              }
              catch (InterruptedException e) {
                  cancel = true;
              }
          }
          if (!cancel && !endTime.after(new Date())) {
              session.removeAttribute(key);
          }
      }
docs: Remove field from session after maxTime is elapsed.