OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session:
Session timeout define action window time for a user thus this window represents, in the same time, the delay in which an attacker can try to steal and use a existing user session...
For this, it's best practices to :
- Set session timeout to the minimal value possible depending on the context of the application.
- Avoid "infinite" session timeout.
- Prefer declarative definition of the session timeout in order to apply global timeout for all application sessions.
- Trace session creation/destroy in order to analyse creation trend and try to detect anormal session number creation (application profiling phase in a attack).
Once hijacked, the attacker will be able to prevent an idle timeout (via activity), and I would consider any successful session hijack a security breach anyway (unless you want to argue how much larger than zero seconds of access an attacker can have before it actually counts as an actual breach).
If the original method of getting the session token can be repeated, this seems to further limit the usefulness of a timeout -- a 5-minute window that can be repeated indefinitely is effectively not limited.
What real-world attack exists (even theoretically) where a session timeout would be an effective mitigation? Is session expiry really just a form of security-theater?