I am working on a banking site, is it a good practice to have session expiry popup alert for users assistance.
I feel it helps from the pain of re-login the site every now and then.
Please correct me if I am missing on any important aspect.
There are a few banks' that uses this technique, and I think it’s perfectly OK. It alerts the user to do something if she shouldn’t be automatically logged out. It’s quite common in Sweden and I would imagine it to be quite common in the rest of the world.
However (when we’re talking bank automatic sign out) don’t implement a feature that one of my banks uses. It automatically signs me out if I (a) hit the back button on the browser and (b) if I do something when the page isn’t fully loaded. Guess what my experience as a user was when I realized that it kept happening over and over again because of their heavy script pages didn’t load fast enough. It’s one of those times where you in frenzy trash your screen even if you do know it doesn’t help at all.
So yes, pop-up is good but disregard
If you use a pop-up when it is really necessary (i.e. user hasn't been using the website for sometime and you want to let them know you're logging them off to protect their identity), then it's OK. Examples: banking web site, credit history info, etc. On other websites where user information is not that sensitive I wouldn't recommend doing the timed log off at all.
When the session expiration timer ticking every second, it puts a lot of pressure on the user. He would probably click 'stay logged in' and then close the page if he doesn't need it over pressing 'log off', because he needs to do something quick. In terms of the timer, I would suggest ticking it every minute until one minute left, then every ten seconds until 10-15 seconds, and then every second until automatic log off. The less pressure, the more effective and happy users you get.
Also, if your user was entering some information to the website and then went away for whatever reason, in some cases it makes sense to save the information and ask to restore it next time he comes back to the same page. This way if your user was doing something and then went away and missed the notification, he will not be forced to start all over again.
The popup is a good option, not that common as far as I can tell from my ban experience, but useful.
One thing that makes the popup useful, is also to have it with time enough to react, for instance, one bank that has this feature, had the popup alert for 10 seconds, which was a very short time, even if you are in front of the computer, but doing something else. They change it to 1 minute which is better; I think I prefer something between 2 and 3 minutes.
Other thing, is make the message clear and don't put any non required things on the popup, by that I mean, that you can use the logo of the bank if you want, but don't put promotions, banners, extra colours or anything else that may distract the user from the relevance of the message. Yes, that happens, It happened for some time in the same bank I mentioned before when they changed to 1 minute. They put a rotating banner.
According to the Web Content Accessibility Guidelines, the user should be warned and provided the opportunity to extend the time and/or have the opportunity to remove the timer. Thus, if you want to be accessible, yes, you would keep the timer.
If you are concerned that it is distracting, you can try to find creative ways to integrate it into the design of the page better. For instance, have it appear in what was previously whitespace, so that it is visible but not covering up the area of the page that the user is interacting with.
As always, one has to think what's the use case, what's in the user's mind.
Must ... close ... session
On the other hand, automatically closing the session saves the user from somebody else transferring all the money stashed in the bank along years of savings.
The long form case
Back to the user who laboriously filled the long form and went to the bathroom, most systems use a sliding window session timeout, that is, the timeout period renews after each interaction of the user (browser) with the server.
What's the user doing?
Our other issue is to save the user from having to login again.
Save partial data
Another nice touch would be to save the data of partially filled forms, as @Noemi suggested. This feature might make the user love that particular bank, and not to worry a bit about having to login again.