What is the point of the sign-in timeout of Microsoft services?

Question

The sign-in process of Microsoft services has a timeout whereby if you wait too long to input a password, the sign-in dialog expires and you need to refresh the dialog.

For example, this is what happens if Microsoft Teams asks me to sign-in again in the middle of the night and I only input the password in the morning:

What's the point of such a timeout? The only thing it achieves is forcing me to paste the password and hit the "Sign in" button again, which is a pure waste of time, not to mention that I get this dialog many times per day from various Microsoft services, due to the security policy of our client.

Answer 1

My best guess is that they may try to protect you from session fixation attacks.

A short (and simplified) description of a way this attack can take place is that, when you first connect (note: connect means getting the landing page, not logging in) to a system (e.g. website) you may start an anonymous session (for various reasons, e.g. anonymous user behaviour analysis or multi-step account registration). This session has an id and is called pre-authentication session. It may be possible that the same session id can be used to identify you post-authentication (I'm not sure whether Microsoft does this, but it is what some sites do). So, here's where the problem lies; lets say that while using your computer at your work, you visit a site, you are given a (pre-authentication) session id, you hit the login button and (for whatever reason) you get up and leave your computer unattended for some time. At this point, a malicious colleague of yours may come to your computer, find out the session id and copy it. Then you return and login as expected. If the site uses the same session id to identify you after you login, since the attacker also has it, she can now use the site by impersonating you.

Another scenario would be that a malicious user can launch a client (e.g. browser) in a commonly used computer (e.g. internet cafe, or library), visit a page, copy the pre-authentication session id and then leave the computer. The next person to sit on the computer may just go on and login, giving essentially access to her account to the malicious user.

Microsoft Teams is just a client for Microsoft's related service, so during the login step it may have a pre-authentication session id assigned to you. As such, a login timeout is in order.

Note that I'm not suggesting that Microsoft Teams uses the same session id for pre- and post-authentication, I'm just saying that my take on the timeout is because of this. It may be that because it's listed as a counter measure in OWASP's session management cheat sheet they just implemented it anyways, even if this attack may not be applicable to the specific client.

You may want to also read this answer to a similar question.

Answer 2

While we can only speculate, it is also possible that this behavior is not for security, but just a sideeffect of how their sessions work.

• As explained in Spyros' answer, it is possible that the server creates an (anonymous) session for you even before logging in. This session will probably time out after a while, maybe for security reasons, or simply because old sessions are cleaned up periodially. As an example, JSF (Jakarta Server Faces) works like this.
• Or maybe something else is timing out, such as the cookie.
• Or maybe they just want to force a browser reload after a while, so the browser receives a current version of the page (in case there was a server update).

We can only speculate why they do this - but it may not be for security reasons.