How long do you keep your customers logged in? (sessions and authentication)

Question

I was curious how long do you think we should keep users logged in before they're required to sign in with username and password again?

I was wondering if there's any resources or studies done to show that there's been better user experience when keeping users logged in longer vs shorter.

Answer 1

The length of a user staying logged in until they are automatically logged out depends on the sensitivity of the data. While it is perfectly fine for a bank to sign out their users after 5 or 10 minutes of idling, this would be a very frustrating experience for a social network or online shop.

There is no direct rule and for as far as I know not even a study about the session length, as it highly depends on your platform and what the users are supposed to do. The question you should be asking is, how important is the user data security to you?

This will lead you to the question "how short do you keep your customers logged in?". And more important than the time is, how you should logout your users. Instead of using a direct time-span, it should be an idle time, like banks are using it. But that last part is just me philosophing around.

I attached you a some links that might help you.

• Deconstructing the Poor Design of a Well-Intentioned Microinteraction
• SSA Accessibility Best Practices Library - Timeout
• Session Timeout – another useless Security Brainchild?

Answer 2

I think as long as possible, without posing a security risk. You should make some rules and consistently improve upon them. Like start with @marvinpoo recommended idle time. Then you can add later on check for impossible behaviour like requesting two pages within microseconds, change of location within a browsing session(use this with grain of salt as mobile networks keep changing I.P), too many 404s.

I think you should also learn from big names like facebook and google. They take more than just time in consideration. They hardly ever log you out. When you are accessing something sensitive ask for password again, but not log them out. Only log them out after days of inactivity. You could refresh authentication token at every 24 hours with 30 days of expiry, and then ask for password again when they access something sensitive(of course with some validity period).