1

I am in the middle of building a system that will require a session time out. Anyone have a best practice here as far as time to give before it actually times out?

Currently I am planning for a pop up to display "Your session will expire in 15 seconds" with a countdown appearing and two buttons. One saying 'continue' and the other 'log-out'.

Thanks!

2
  • 1
    Does this post give you some pointers? - ux.stackexchange.com/questions/30426/…?
    – JonW
    Oct 29, 2013 at 9:56
  • I wouldn't agree much with this. A constant timer will just make the user more anxious, distracting them from their actual tasks they are doing in the application.
    – ar ski
    Mar 25, 2020 at 10:37

2 Answers 2

1

You should make the timeout as long as your security needs will allow. There is no UX benefit to a short timeout.

4
  • I think he's talking about displaying a notification to someone to let them know their session is about to expire, rather than what the actual session timeout period should be :-) I also wouldn't say there's no benefit to UX with a short timeout... I wouldn't be frustrated if my bank automatically signed me out after 5 minutes of inactivity, because it'd be potentially dangerous to leave it open. I actually feel a bit safer when I do encounter that, even though I have to sign in again.
    – Kip
    Oct 28, 2013 at 22:02
  • Maybe I misunderstood, but I read the question again and it still sounds like he's asking the question I answered. Also, the bank website case falls into the "as long as your security needs will allow" caveat.
    – Jeremy T
    Oct 28, 2013 at 22:36
  • You are both right. I was asking about the actual session time itself and when we should display the session is about to expire pop up. I love the bank idea of timing your session and resetting upon actions. Really cool, thanks all!
    – Ryan
    Oct 29, 2013 at 14:28
  • "I wouldn't be frustrated if my bank automatically signed me out after 5 minutes of inactivity, because it'd be potentially dangerous to leave it open." combined with an OTP mechanism for every login, you would get frustrated very quickly I am sure.
    – straya
    Jan 30, 2020 at 5:14
0

Of course it depends on the type of application you're building, but you should consider handling and displaying timeouts the way some online-banking-providers do it:

countdown

It's a small clock in the corner next to some rarely used sections like "settings" and so on. You can easily see how long your session ist still valid.

And here comes the big UX-Plus: Whenever you perform some action, like transferring money to someone else, the countdown resets to 10 minutes.

This way customers can take as much time as they need. If they forget to log-off - no problem, session does not re-validate itself, since the actions that refresh the session are those that require a password.

5
  • 1
    I'm not sure I'm a big fan of this idea, as a ticking clock will cause some degree of anxiety for users that may not have otherwise been affected by it at all.
    – Jeremy T
    Oct 29, 2013 at 16:05
  • @JeremyTunnell you might be correct. but I still feel that it's nicer for the users to know that something is going to happen instead of suddenly telling them "your session timed out!"
    – Lovis
    Oct 29, 2013 at 16:09
  • 1
    Miller Agreed, but I still think the correct compromise is to show nothing until the last 30 seconds or so before timeout
    – Jeremy T
    Nov 1, 2013 at 16:10
  • @JeremyTunnell maybe, someone should make research about it. But I really don't think that many people even noticed the countdown on the banking-webpage.
    – Lovis
    Nov 1, 2013 at 16:19
  • The likelihood of a User seeing a message in the last 30 seconds before timeout for a 15 minute session window is quite low. If the User does see it, they may be coerced into actioning something they would have otherwise taken more care with. This urgency feedback is mostly used in eCommerce with the aim to encourage a commitment. Flip side: when a session does expire, provide a message to educate the User as to the reason (including the session duration), then the User learns from experience (often the best way to learn).
    – straya
    Jan 30, 2020 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.