1

Currently I am designing a security product for which the session timer is 15 mins after you will be logged out. Should I

  • a) Show the user a small modal which says they have been logged out
  • b) Show them the login page itself

Showing the login page would mean less effort for the users and they can use the login page to get back to where they were.

Atlassian shows a message to the user that they have been logged out.

enter image description here

How would I go about evaluating this problem? I thought about using KLM Goms but with just an added extra step the results didn't matter at all.

0

Show them everything, but progressively

You can have a session logout page that explains to the user that they have been logged out, why it happened and how they can resume using the product. The page should have a login form embedded below the explanation. If they can be returned to the last activity please do so and indicate this in your explanation.

0

If the user is logged out due to a timer, it could be they stepped away from their desk. (Note that the Atlassian example indicates the user logged out explicitly, not a session timeout).

If that is the case, leaving the last page they were looking at open and showing a modal could reveal what they were working on.

I would then return the user to the login page, with a notice saying their session was logged out due to inactivity. This gives them information when they return and also prevents any onlookers from seeing anything they were working on after they are logged out.

By your own measure, this is also convenient for the user, so it is a rare case of convenience AND security (when you normally have to balance the two against each other.)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.