Should I run the session idle timeout timer
- From the start of the first request to the start of the next request, or
- From the end of the first request to the start of the next request?
A bit of context - I have a 10 minute idle timeout on a Web API application. Some of the requests take a long time (say around 8 minutes). If I do 1., users effectively lose 8 minutes of their idle quota on these requests. If I do 2., it does not sit well with the definition of idle - the user has been (forced to be) idle since initiating the first request.
I'm inclined to 2. because of UX but definition concerns aside, is there any way 2. could be misused?
I believe the idle timeout is in place for most of the reasons as in https://security.stackexchange.com/a/54668/164690 and am ok for any answers to focus on these requirements (unfortunately, I can't find any formal requirements supporting my belief - the current system is based on a very old system, whose requirements are unfortunately lost in the annals of time. For the same reason, I'm not sure why 10 minutes and not 9 or 11). That said, I am curious as to whether there are any sort of security loopholes that can utilize 2. and not 1.
Note - I also have an absolute timeout running from the start of the session