Take the 2-minute tour ×

My company has created lots of computer software but one issue we have is with login timeouts.

Some developers want to make them shorter for security, while most users want it be infinite? Is there ever a justification to have no login timeout? How short is too short?

share|improve this question
A lot of the annoyance of login timeouts can be mitigated by remembering (hashed) passwords, web apps are especially good at this since browsers do it for you, but that may not help in your situation. –  Ben Brocka Sep 22 '11 at 13:58
In my opinion an open tab/or page should not timeout. After the user leaves the page it can immediatly timeout. –  Barfieldmv Sep 22 '11 at 14:51
add comment

4 Answers

up vote 8 down vote accepted

The length of the time out is partly dependent on the sensitivity of the data and security of the application.

For something like a banking site the time out needs to be quite short so that there is very little chance of someone getting access to the account if the user fails to log off.

For something like Facebook the time out can be longer - though even there I think there should be some time out as there is still sensitive information someone could get access to.

How short is too short? - if the user can't complete the most common actions within the time out then it's too short. For example, if you are reviewing your bank statement you need the data to be visible for a few minutes so you can mark off transactions etc. Any shorter and you'd have to refresh the page and could lose your place.

For your application you'll need to time common activities and make the time out a little longer than that.

share|improve this answer
Think also about the task performed. Sometime your user might need to fill in some information and then call someone, send an email or simply walk to somebody else's desk to fill in the rest of the information. Spend some time with the users and analyze this behavior, to see how many time is the appropriate time. –  Pedro Sep 22 '11 at 14:22
My bank logs me out after 5', which is too short for me, and worse, when I hit the 'back' button (Ok [ctrl]+left arrow). It annoys me greatly. –  GUI Junkie Sep 28 '11 at 20:22
add comment

The justification for login timeouts depends on the security level of your application and the how the users use the app. If your app handles financial/sensitive data, the login timeout should be short (logically), approx. 3-5 minutes.

If your app is a CMS, use a longer timeout. I would suggest approx. 45-60 minutes. This is to prevent content administrators from loosing content or content formatting if they are on the WYSIWYG editor screen for 30 minutes, which I frequently see.

In regards to justification for no timeout at all; I have one site that has a no login timeout. It is specifically for sales reps that always forget their passwords. This was a required feature by the client, not my normal best practice. Everyone has their specific needs and business objectives.

My strongest recommendation here is, know the audience. Make sure you understand what the users are doing and how long they are one a page on your site before setting up a login timeout.

share|improve this answer
add comment

In Web apps ( if you are referring to that) the timeout is reset everytime the server hears from you. this can lead to a user getting logged out even if he is using your site, reading, observing data, writing content etc. as long as he causes no new requests to be made.

Consider detecting user activity through mouse/keyboard/scroll events and triggering every x mins an ajax request to keep the timeout long. This will also enable you to set a shorter timeout, so that when the user finally leaves the computer, he is logged out fast. (if security is a concern)

share|improve this answer
Nice idea! I always thought it is impossible to know if a certain page tag is still open or not, but of course, via AJAX you can. And even if it stays open, but inactive, for some time, a re-login window could appear, just like a screensaver does. –  giraff Sep 28 '11 at 7:10
add comment

Consider also what you do when there is a request to the server after a timeout. Do not just reject the request or redirect the page. Maybe an in-page popup to allow you to log in again, but consider carefully the user story if their session does timeout.

If you handle the timeout process neatly, you can reduce your timeout, which is a positive for security. If you expect users to be spending a lot of time reading or filling out pages then keep the timeout longer.

So consider your users, and consider your timeout story.

share|improve this answer
add comment

Your Answer


