fix(web-common): add limit for timeout

experimental/CHANGELOG.md

@@ -22,6 +22,7 @@ For notes on migrating to 2.x / 0.200.x see [the upgrade guide](doc/upgrade-to-2
 * fix(instrumentation-fetch): preserve init overrides when input is a Request object [#6421](https://github.com/open-telemetry/opentelemetry-js/issues/6421) @akandic47
 * fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MiB [#6552](https://github.com/open-telemetry/opentelemetry-js/pull/6552) @kartikgola
 * fix(web-common): add check for possible unsafe json parse [#6589](https://github.com/open-telemetry/opentelemetry-js/pull/6589) @maryliag
+* fix(web-common): add limit for timeout [#x](https://github.com/open-telemetry/opentelemetry-js/pull/x) @maryliag
 
 ### :books: Documentation
 

experimental/packages/web-common/src/SessionManager.ts

@@ -145,9 +145,13 @@ export class SessionManager implements SessionProvider, SessionPublisher {
       clearTimeout(this._inactivityTimeoutId);
     }
 
+    const timeoutIn = Math.min(
+      this._inactivityTimeout * 1000,
+      2147483647 // max setTimeout value
+    );
     this._inactivityTimeoutId = setTimeout(() => {
       this.resetSession();
-    }, this._inactivityTimeout * 1000);
+    }, timeoutIn);
   }
 
   private resetMaxDurationTimer() {
@@ -159,8 +163,10 @@ export class SessionManager implements SessionProvider, SessionPublisher {
       clearTimeout(this._maxDurationTimeoutId);
     }
 
-    const timeoutIn =
-      this._maxDuration * 1000 - (Date.now() - this._session?.startTimestamp);
+    const timeoutIn = Math.min(
+      this._maxDuration * 1000 - (Date.now() - this._session?.startTimestamp),
+      2147483647 // max setTimeout value
+    );
 
     this._maxDurationTimeoutId = setTimeout(() => {
       this.resetSession();