When to use instance variables in servlets.

As a general rule of thumb: never create instance variables in a servlet unless you really understand how servlets work in regards to threading. Containers will create one instance of your servlet and call your servlet's service methods (doGet, doPost, etc...) from within a separate thread for each request. This means that any instance varaibles will be shared among all of your requests.

Here is a link that explains when instance variables should and shouldn't be used in servlets.

For password changing is it advisable to set the password in session as attribute and check it while modifying.

NO. Always retrive the password from database while making a comparison check to allow the user to change password.

We are facing a problem with session timeout. As per requirement we need to have different timeout values for different pages. i.e. to say 40 min for page A and 45 min for page B. Is there any way this configuration can be done.

You can change it at runtime but changing one page will affect them all.There is only one session object per session.

setMaxInactiveInterval(int)

If you want a per-page timeout, you will have to do it with some other mechanism besides the session -- probably JavaScript timers on the various pages.