1

I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once.

Our implementation of the login server (RubyCAS) auto-expires these tickets after 90 seconds. Ie. if a user takes longer than than time to enter his/her login credentials, the login attempt will fail with an error message. This behaviour is considered annoying by my users.

Now my question is, what are the security implications of not limiting the time frame of login sessions? Or put another way: Are time limits on the login screen a good idea?

Improve this question
3
  • 1
    Generally, they're a good idea. Small time frame for the ticket to be leaked somehow. But that's not the angle you need to think about. I think a better way of approaching this is relaxing the limit rather than abolishing it. Look at your users, see the average time they take, then double it for convenience.
    – Adi
    Commented Jun 12, 2013 at 9:06
  • 1
    What @Adnan said, plus, if you have the time and logs, try to graph the time they take to get an even better idea of how long it takes them. If most of them take more than 10 minutes, it could be that the problem is more fundamental (slow email delivery, no way to get email more often than once a minute, or similar).
    – l0b0
    Commented Jun 12, 2013 at 9:14
  • For example, Steam uses tokens which are valid for only a minute, which is really frustrating when delivery takes much longer.
    – l0b0
    Commented Jun 12, 2013 at 9:21

0

Reset to default

Browse other questions tagged .