I think this is the answer: http://stackoverflow.com/questions/14433070/default-session-timeout-for-apache-tomcat-applications
Open tomcat_home/conf/web.xml and find this
<!-- ==================== Default Session Configuration ================= -->
<!-- You can set the default session timeout (in minutes) for all newly -->
<!-- created sessions by modifying the value below. -->
<session-config>
<session-timeout>30</session-timeout>
</session-config>