This question already has an answer here:

I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once.

Our implementation of the login server (RubyCAS) auto-expires these tickets after 90 seconds. Ie. if a user takes longer than than time to enter his/her login credentials, the login attempt will fail with an error message. This behaviour is considered annoying by my users.

Now my question is, what are the security implications of not limiting the time frame of login sessions? Or put another way: Are time limits on the login screen a good idea?

marked as duplicate by TildalWave, NULLZ, user10211, Scott Pack, Polynomial Jun 12 '13 at 13:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Generally, they're a good idea. Small time frame for the ticket to be leaked somehow. But that's not the angle you need to think about. I think a better way of approaching this is relaxing the limit rather than abolishing it. Look at your users, see the average time they take, then double it for convenience. – Adi Jun 12 '13 at 9:06
  • 1
    What @Adnan said, plus, if you have the time and logs, try to graph the time they take to get an even better idea of how long it takes them. If most of them take more than 10 minutes, it could be that the problem is more fundamental (slow email delivery, no way to get email more often than once a minute, or similar). – l0b0 Jun 12 '13 at 9:14
  • For example, Steam uses tokens which are valid for only a minute, which is really frustrating when delivery takes much longer. – l0b0 Jun 12 '13 at 9:21

Browse other questions tagged or ask your own question.