Our web app has idle time-out of 30 minutes. Ideally it won't happen, but if it occurs, how to inform the user?

My thoughts are

  1. Prompt the user when attempting (clicking item/keyboard action) at the 31st minute, that session has expired and log in again

  2. Redirect the user to login screen, and overlay message, logged out due to inactivity.

Preferring to go with the second option. Any other alternatives or suggestions, please.

3 Answers 3


I'm just adding to Rob and MMM's answer but I agree it may benefit users more to have the second option you mentioned—an overlay message before redirecting.

Though, it depends on what your web application deals with. If it deals with a lot of security, data filling and/or anything complex, having a warning or a countdown allows the users to be notified ahead of time in case they were in the middle of something on that page, otherwise they can lose whatever they were working on.

From my personal encounters with bank sessions, timed tests, etc., I'm usually prompted like so.

enter image description here

I appreciate this extra step more than coming back with a notification that I instantly got logged off and can't rescind it. So perhaps with your web application, I'd go with something similar—having a huge countdown also helps.



enter image description here


enter image description here

(Source: Hannah Chen via dribbble)


Here are other questions I've encountered that help and provide me with good insight. Hopefully they'll be of some use for you as well.

Best Practices for Warning of Session Expiration

What are the best practices for implementing a session timeout/expiry in a website, being security as the main concern?


If you give any prompt make it preemptive.

Regarding the first option, there is little point prompting them that the session has expired and then redirecting them. This just adds clicks and time onto the user.

It's better to give a 2 or 3 minute warning before the app logs out automatically.

Bottom line: Go with the second option but give them a preemptive inactivity warning before the fact.


You can give the user assurance that nothing is lost by showing him the app state he left under a semi-transparent overlay with message/ login (if nothing is sensitive).

I thinking pushing the state at min 30 may be better than reacting to a click. The user would receive something else from his interaction. The click would be needed again after login anyways.

As Rob suggested, showing a preemptive, non-intrusive message is a nice touch too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.