My application is required by our security team to log users out after 20 minutes of inactivity. We don't currently have a message warning users that this will happen, leading to confusion/frustration for users. Is there an industry for how soon a message should appear? The last 10% of the timer? I.E. 2 minutes in my scenario.
3
-
Maybe also this question helps you– NashMay 24, 2021 at 19:22
-
1Does this answer your question? How should I correctly implement a timeout warning?– DevinMay 24, 2021 at 19:38
-
That question doesn't address when the timeout warning should appear, which is what this question's about.– Ken MohnkernMay 26, 2021 at 19:47
Add a comment
|
3 Answers
There is no industry standard, but there are plenty of patterns, best practices you can use.
I think, you should do a so-called best practice research and examine similar applications, services. Typically, the banking sector and eGov sites are using timed login solutions for security purpose. For example, the most common element of these is a time counter. And usually, there are no popup before it logs you out. If the user reaches the inactivity threshold, it assumes that the user is no longer at the computer and logs it out without any warning to prevent any security issue. If the user is not there, no popup message or dialog will help or work. This is why they are using a counter instead. There are several solutions. Some of them resets the count-down after each interaction and have a few second delay.
For example, it starts to count down the timer after 20-30 seconds of inactivity (this is the delay) and resets the counter right after the first interaction.
The count-down shows 10 minutes > the user did something on the webpage, filled some forms, etc. > then moved to another tab of the browser or had to go out for his/her wallet because the form is asking for ID or credit card number > the count-down starts after 30 seconds of inactivity > the user gets back after 3 minutes, the count-down is currently showing 7 minutes 10 second > the user stars to type the credit card number into the input field > the count-down resets back to 10 minutes.
I don't know if an industry standard exists, but the project I'm working on pops a warning one minute before timeout and that's worked for our users for years.
answered May 26, 2021 at 19:43
-
1I think I've seen the 1 minute timeframe used in some mobile banking apps. May 27, 2021 at 9:45
I don't think there should be any warnings or popups. For example, if there's actually an intruder who gets their hand on the computer / mobile phone with your application logged in, and a popup appears with the reminder, it will be even worse for security. The whole point of session time out is logging the user out if they are away and unintentionally forgot to log out of the application.
