Should users be shown a login page or the same page they were in after their session timer expires?

Question

Currently I am designing a security product for which the session timer is 15 mins after you will be logged out. Should I

• a) Show the user a small modal which says they have been logged out
• b) Show them the login page itself

Showing the login page would mean less effort for the users and they can use the login page to get back to where they were.

Atlassian shows a message to the user that they have been logged out.

How would I go about evaluating this problem? I thought about using KLM Goms but with just an added extra step the results didn't matter at all.

Answer 1

Show them everything, but progressively

You can have a session logout page that explains to the user that they have been logged out, why it happened and how they can resume using the product. The page should have a login form embedded below the explanation. If they can be returned to the last activity please do so and indicate this in your explanation.

Answer 2

If the user is logged out due to a timer, it could be they stepped away from their desk. (Note that the Atlassian example indicates the user logged out explicitly, not a session timeout).

If that is the case, leaving the last page they were looking at open and showing a modal could reveal what they were working on.

I would then return the user to the login page, with a notice saying their session was logged out due to inactivity. This gives them information when they return and also prevents any onlookers from seeing anything they were working on after they are logged out.

By your own measure, this is also convenient for the user, so it is a rare case of convenience AND security (when you normally have to balance the two against each other.)

Answer 3

Why do sessions and session expiry exist? Some will say "because security", which is in the right direction but overlooking the real reasons. They exist initially because of non-personal devices such as web kiosks and internet cafes, but later made a lot of sense in large open-planned offices too (though policy and contracts play a big role there, making the need for sessions a bit moot). These days they exist because of best-practices, duty-of-care, standards, and compliance requirements but all stemming from the initial problem scenarios regarding non-personal device use.

So, given your session expires on a web kiosk or computer in an internet cafe, is it wise to display parts of the potentially sensitive information that was being viewed prior to the session expiring? NO.