This question already has an answer here:
I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once.
Our implementation of the login server (RubyCAS) auto-expires these tickets after 90 seconds. Ie. if a user takes longer than than time to enter his/her login credentials, the login attempt will fail with an error message. This behaviour is considered annoying by my users.
Now my question is, what are the security implications of not limiting the time frame of login sessions? Or put another way: Are time limits on the login screen a good idea?