Is it a good practice to have a session expiry popup with timer for user assistance

Question

I am working on a banking site, is it a good practice to have session expiry popup alert for users assistance.

I feel it helps from the pain of re-login the site every now and then.

Please correct me if I am missing on any important aspect.

Answer 1

As always, one has to think what's the use case, what's in the user's mind.
Preserving the session saves the user to have to login again, but might also save her to have to fill again a long form.
The latter case, obviously, deserves special consideration.

Must ... close ... session

On the other hand, automatically closing the session saves the user from somebody else transferring all the money stashed in the bank along years of savings.
So, the session has to be automatically closed the sooner, the better for security reasons.

The long form case

Back to the user who laboriously filled the long form and went to the bathroom, most systems use a sliding window session timeout, that is, the timeout period renews after each interaction of the user (browser) with the server.
The issue is in the definition of each interaction.
For example if the session timeout if set at 15 minutes, and it takes 16 minutes to fill the form then the user is doomed.
But if the browser silently produced an interaction say, each time the user gives focus to the next form field, then she would have always 15' to get a tea cup and continue working.
So, with this we deactivate the long form filling problem.

What's the user doing?

Our other issue is to save the user from having to login again.
The problem is that we don't know if she is chatting in facebook or has left till tomorrow, with an open session against her bank buried below a few other windows.
Showing an alert over a buried window doesn't make sense.
Popping up a session soon expiring popup might alert a crook that happens to be hanging around waiting for a chance to do a happy money transfer. If that happened the bank might be found liable.

Save partial data

Another nice touch would be to save the data of partially filled forms, as @Noemi suggested. This feature might make the user love that particular bank, and not to worry a bit about having to login again.
The saved information has to be clean of passwords, credit card numbers, and the like.

Answer 2

According to the Web Content Accessibility Guidelines, the user should be warned and provided the opportunity to extend the time and/or have the opportunity to remove the timer. Thus, if you want to be accessible, yes, you would keep the timer.

If you are concerned that it is distracting, you can try to find creative ways to integrate it into the design of the page better. For instance, have it appear in what was previously whitespace, so that it is visible but not covering up the area of the page that the user is interacting with.

Answer 3

The popup is a good option, not that common as far as I can tell from my ban experience, but useful.

One thing that makes the popup useful, is also to have it with time enough to react, for instance, one bank that has this feature, had the popup alert for 10 seconds, which was a very short time, even if you are in front of the computer, but doing something else. They change it to 1 minute which is better; I think I prefer something between 2 and 3 minutes.

Other thing, is make the message clear and don't put any non required things on the popup, by that I mean, that you can use the logo of the bank if you want, but don't put promotions, banners, extra colours or anything else that may distract the user from the relevance of the message. Yes, that happens, It happened for some time in the same bank I mentioned before when they changed to 1 minute. They put a rotating banner.

Answer 4

If you use a pop-up when it is really necessary (i.e. user hasn't been using the website for sometime and you want to let them know you're logging them off to protect their identity), then it's OK. Examples: banking web site, credit history info, etc. On other websites where user information is not that sensitive I wouldn't recommend doing the timed log off at all.

When the session expiration timer ticking every second, it puts a lot of pressure on the user. He would probably click 'stay logged in' and then close the page if he doesn't need it over pressing 'log off', because he needs to do something quick. In terms of the timer, I would suggest ticking it every minute until one minute left, then every ten seconds until 10-15 seconds, and then every second until automatic log off. The less pressure, the more effective and happy users you get.

Also, if your user was entering some information to the website and then went away for whatever reason, in some cases it makes sense to save the information and ask to restore it next time he comes back to the same page. This way if your user was doing something and then went away and missed the notification, he will not be forced to start all over again.

Answer 5

There are a few banks' that uses this technique, and I think it’s perfectly OK. It alerts the user to do something if she shouldn’t be automatically logged out. It’s quite common in Sweden and I would imagine it to be quite common in the rest of the world.

However (when we’re talking bank automatic sign out) don’t implement a feature that one of my banks uses. It automatically signs me out if I (a) hit the back button on the browser and (b) if I do something when the page isn’t fully loaded. Guess what my experience as a user was when I realized that it kept happening over and over again because of their heavy script pages didn’t load fast enough. It’s one of those times where you in frenzy trash your screen even if you do know it doesn’t help at all.

So yes, pop-up is good but disregard onNotLoadedSignOut() and onBackButtonSignOut().