Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

What's a resonable session timeout limit and how can you determine it?

share|improve this question
2  
That's a good question to ask for a specific application, but as asked here it's too general. The answer will depend on a lot of factors, such as whether you expect users to be on personal or shared machines, whether the user pool is tightly controlled (Intranet) or not (free registration), what kinds of interactions you expect that last longer than one sitting, how much compromise you want between paranoia and usability, how much server load you can afford, etc. – Gilles Jan 14 '12 at 15:08

closed as not a real question by Chris Andrè Dale, Rory Alsop♦ Feb 2 '12 at 14:12

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

3 Answers

up vote 2 down vote

I think it's very related to the task being performed in the session.

How to determine it: verify what the session / program / software would be used to. Measure how long it takes to a regular user perform such activity. The more measures you have, the better. Calculate the average time and standard deviation. Make the timeout limit be average + 2 std dev, and I think that almost every user will be able to use the session before a timeout occurs.

share|improve this answer
up vote 1 down vote

If you are working on a Web scenario, the end user probably would like to see a highlighted message (using CSS and/or JavaScript, JQuery) indicating that the session is about to expire. Some frameworks provide a default Session timeout, You can increase it? Yes you can. So you can know the inactive time and redirect the user to log in again once the session has timeout.

share|improve this answer
up vote 1 down vote

Business / System Requirements

The business requirement will imply the decisions on timeouts. It can be an judgement call taking into account the importance of the transactions made on the site (for the app owner and for the user), the vulnerability of the web application and the various transactions that can be made on it, the end points that will access it and probably the relationship between the owners and users of the service. Legal issues often need to be considered. Often decisions will be informed by what has happened in the past for the application and similar applications in the minds of parties involved.

So in short it is a complex decision.

Remember that some applications might have a longer term 'timeout' using cookies to stay logged on.

AJAX/Javascript Web Applications have technical implications.

  • The ajax actions (for the same application) might reset the timeout, and might be the first to see the timeout action, so need to handle this timeout case.
  • Ajax actions back to other applications/servers cannot reset the timeout.
  • Javascript that doesn't access the server will not reset the timeout.
  • There might be javascript timeouts/actions too.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.