Or put another way - is there a process for deciding how long a user's authenticated session should last?
I don't agree with Edgarator that you should ask the user, especially not at log in.
It is all very nice and well to allow the user to change it, but don't ask them to make a decision that is totally unrelated to what they want to achieve with your application.
Decide a sensible default for yourself - possibly using the criteria Edgarator shows in his answer. Make it short-ish. And DO provide option to change it longer in some settings dialog.
It would be difficult to find a standard time to measure how often to expire a session in a mobile device.
So, what I would do is:
1. To define the user
You might want to think around the lines of:
If this doesn't matter perhaps you could add different session expiry settings at the beginning and learn (by tracking it on your server) from your user how often your standard user like the session to be expired. For example:
2. To define how sensitive the information is:
Pretty much all legal implications here:
|show 1 more comment|