Where to show session has expired

Question

Our web app has idle time-out of 30 minutes. Ideally it won't happen, but if it occurs, how to inform the user?

My thoughts are

1. Prompt the user when attempting (clicking item/keyboard action) at the 31st minute, that session has expired and log in again

2. Redirect the user to login screen, and overlay message, logged out due to inactivity.

Preferring to go with the second option. Any other alternatives or suggestions, please.

Answer 1

I'm just adding to Rob and MMM's answer but I agree it may benefit users more to have the second option you mentioned—an overlay message before redirecting.

Though, it depends on what your web application deals with. If it deals with a lot of security, data filling and/or anything complex, having a warning or a countdown allows the users to be notified ahead of time in case they were in the middle of something on that page, otherwise they can lose whatever they were working on.

From my personal encounters with bank sessions, timed tests, etc., I'm usually prompted like so.

I appreciate this extra step more than coming back with a notification that I instantly got logged off and can't rescind it. So perhaps with your web application, I'd go with something similar—having a huge countdown also helps.

Example

Countdown

Timeout

(Source: Hannah Chen via dribbble)

Links

Here are other questions I've encountered that help and provide me with good insight. Hopefully they'll be of some use for you as well.

Best Practices for Warning of Session Expiration

What are the best practices for implementing a session timeout/expiry in a website, being security as the main concern?

Answer 2

If you give any prompt make it preemptive.

Regarding the first option, there is little point prompting them that the session has expired and then redirecting them. This just adds clicks and time onto the user.

It's better to give a 2 or 3 minute warning before the app logs out automatically.

Bottom line: Go with the second option but give them a preemptive inactivity warning before the fact.

Answer 3

You can give the user assurance that nothing is lost by showing him the app state he left under a semi-transparent overlay with message/ login (if nothing is sensitive).

I thinking pushing the state at min 30 may be better than reacting to a click. The user would receive something else from his interaction. The click would be needed again after login anyways.

As Rob suggested, showing a preemptive, non-intrusive message is a nice touch too.