What's a resonable session timeout limit and how can you determine it?
closed as not a real question by Chris Andrè Dale, Rory Alsop♦ Feb 2 '12 at 14:12
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
I think it's very related to the task being performed in the session.
How to determine it: verify what the session / program / software would be used to. Measure how long it takes to a regular user perform such activity. The more measures you have, the better. Calculate the average time and standard deviation. Make the timeout limit be average + 2 std dev, and I think that almost every user will be able to use the session before a timeout occurs.
Business / System Requirements
The business requirement will imply the decisions on timeouts. It can be an judgement call taking into account the importance of the transactions made on the site (for the app owner and for the user), the vulnerability of the web application and the various transactions that can be made on it, the end points that will access it and probably the relationship between the owners and users of the service. Legal issues often need to be considered. Often decisions will be informed by what has happened in the past for the application and similar applications in the minds of parties involved.
So in short it is a complex decision.
Remember that some applications might have a longer term 'timeout' using cookies to stay logged on.