User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
We recently did a survey for our website, and one of the main complaints we received is that our customers are getting logged out and need to log back in.
We have a 15 minute expiration set currently and we're wondering if there's any sort of standard time or best practices (perhaps a study) on how long this should be set?
Session expiration time is context dependent, and more Security related than User Experience related. In fact Security and User Experience have divergent goals here. Users dislike to log in again when session expired, but from a security viewpoint short session times protects our users from fraud.
In Sweden at least, there is a silent agreement among financial institutions to have a ten minute session expiration time. But if your app or web app don't handle money or other sensitive information, you can use weeks instead of minutes on session expiration time.
