OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It means that the application forces user to re-authenticate regardless of session activity.
Is there any recommendations for the duration of that timeout to be secure enough and not annoy end users? Would it be enough to set an absolute session timeout to 24 hours? more?
The application I'm working on will be placed within internal corporate network and is used by users to perform their every day job responisbilites so frequest re-authentication request can be a usability issue.