Java EE (Java Enterprise Edition) General Discussion

I store a large amount of session objects for each session on my site. I set the <session-timeout> parameter in my web.xml to 20 minutes. This value is used for users that have logged into the site. I use session.setMaxInactiveInterval(-1) within a servlet, for those that didn't log in. So -1 indicates that the session doesn't expire until the browser window closes, correct? If so, I have decided that this is not efficient enough.

The session objects take up memory, and I am currently experiencing memory problems on my vps (virtual private server). After only a few requests to pages on my site, the memory is increasing, and during inactivity, also increasing. Memory usage stays steady, but at a high number, and it doesn't seem to be releasing. I'm considering many things in trying to get this figured out.

Step 1 was making sure that my ResultSet, Statement and Connection objects are properly closed, since I am using connection pooling.

On one site I came across, a person stated the following - "Even though a session may timeout, it is not invalidated yet. There is a clear difference here."

So my questions are the following -_
1) With setMaxInactiveInterval, is the session invalidated? Meaning all session objects that were bound to the session have been invalidate/removed/released? If so, I will use this method then.

2) What benefit then, is <session-timeout> if it doesn't invalidate the session?