Sorry for being late at the party, but isn't the obvious solution to just call and use the servlet container's functionality (maybe I am missing a detail but that's how I would do it): org.zkoss.zk.ui.http.SimpleSession.setMaxInactiveInterval(int))

This needs to be called only once when the user is determined (and his specific timeout is loaded from the DB) right after he logged in. Then no Timer and manual session eviction is required. To give the user instant feedback on the client side, that he logged out use the <automatic-timeout/> element.

Sorry for being late at the party, but isn't the obvious solution to just call and use the servlet container's functionality (maybe I am missing a detail but that's how I would do it): org.zkoss.zk.ui.http.SimpleSession.setMaxInactiveInterval(int))

This needs to be called only once when the user is determined (and his specific timeout is loaded from the DB) right after he logged in. Then no Timer and manual session eviction is required. To give the user instant feedback on the client side, that he logged his session has timed out use the <automatic-timeout/> element.