Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

We recently did a survey for our website, and one of the main complaints we received is that our customers are getting logged out and need to log back in.

We have a 15 minute expiration set currently and we're wondering if there's any sort of standard time or best practices (perhaps a study) on how long this should be set?

share|improve this question
2  
Hi Patrick. Welcome to the UX Stack Exchange! Can you give us some context? What is the purpose of the site? Who are its main users? What are they trying to accomplish within this time limit? –  3nafish May 17 '13 at 23:44

1 Answer 1

Session expiration time is context dependent, and more Security related than User Experience related. In fact Security and User Experience have divergent goals here. Users dislike to log in again when session expired, but from a security viewpoint short session times protects our users from fraud.

In Sweden at least, there is a silent agreement among financial institutions to have a ten minute session expiration time. But if your app or web app don't handle money or other sensitive information, you can use weeks instead of minutes on session expiration time.

share|improve this answer
    
Thank you-- we do take payments but a lot of our site is just casual browsing. Are there ways to separate the two? For example, have session expiration kick in for the payment processing page but not for others? I know that google makes you log in again for their account pages, but not for browsing or email, even. Does this make sense? I'm trying to find a happy medium. –  Patrick May 21 '13 at 18:24
    
@Patrick Interesting. I think you can apply the style of LinkedIn where you get the number of notications on your account even if you're not signed in. When you want to read the notifications (or in your case, make an order or pay for something) make your users sign in again. No one is bothered - and your users feel secure! –  Benny Skogberg MCSA May 21 '13 at 19:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.