You can specify the timeout of a session in the deployment descriptor of your web application (web.xml):
<web-app>
<session-config>
<session-timeout>60</session-timeout>
</session-config>
...
</web-app>
The number within the session-timout element must be expressed in minutes.
Be sure to restart Tomcat to take the new setting.