You may want to first read about the difference between a session and a cookie.

There are two session management levels. You can set the session management settings at the application server level, or at the application level. The settings at the application level will take precedence over the settings at the application server level.

Application:

1. In the left panel of the WebSphere web console, expand Application > Application Types, and select Websphere enterprise applications.
2. Select an application.
3. Select Session management.

Application server:

1. In the left panel of the WebSphere web console, expand Server > Server Types, and select Websphere applications servers.
2. Select an application server.
3. Select Session management.

The default, the session will be destroyed after 30 minutes. If you change the timeout, restart the application or restart the JVM for this change to take effect.

For demonstration purposes, the screen shot below shows a Java app displaying the session ID number.

Then, after 30 minutes, the app has a new session ID number, since the prior session timed out after 30 minutes.