I'm wondering if there's a specific 'standard' time for logging users out of a website that contains sensitive information and data. I am thinking that kicking them off the website in 24 hours could be a little inconvenient and frustrating, so extending the session time beyond 24 hours might be an option. Does anyone know any other options/solutions for this matter?
-
6Hello Viktoria, and welcome to UX.SE. The recommendation will be highly dependent on what kind of service you're talking about. For example, my bank account logs me out after only ~15 minutes of inactivity. On the other hand, I can't remember the last time I had to log back in to my music streaming service. So really, the rule of thumb is just to balance how secure your site needs to be with user convenience. I'm glad my bank keeps my account locked down, and I'm glad my music streaming service doesn't make me log in every day.– maxathousandCommented Feb 7, 2020 at 18:40
Add a comment
|
1 Answer
As per maxathousand's comment: it should be based on a risk assessment. I would add that it should also be based on consideration of you users and their routines.
The existence of session windows allows a User to access a system without having to relog, sometimes it may go further in allowing a User to pick-up where they left-off (i.e. avoid having to repeat certain hurdles again). Choosing a session window of 24 hours is like saying: the User logged in and did something, but if they are going to continue to do that tomorrow they will be doing it at an earlier time of day than today.
As you can see, that won't fit most peoples' routines (if they have routines). E.g. if someone finished work, got home, and started using your system then had to leave to do other things, you leave them a very narrow practical window to reuse that session the next day (assuming they have work finishing at the same time).
