11

We recently did a survey for our website, and one of the main complaints we received is that our customers are getting logged out and need to log back in.

We have a 15 minute expiration set currently and we're wondering if there's any sort of standard time or best practices (perhaps a study) on how long this should be set?

2
  • 2
    Hi Patrick. Welcome to the UX Stack Exchange! Can you give us some context? What is the purpose of the site? Who are its main users? What are they trying to accomplish within this time limit? May 17 '13 at 23:44
  • There are some sessions time out suggestions for OWASP owasp.org/index.php/… Oct 5 '15 at 15:24
8

Session expiration time is context dependent, and more Security related than User Experience related. In fact Security and User Experience have divergent goals here. Users dislike to log in again when session expired, but from a security viewpoint short session times protects our users from fraud.

In Sweden at least, there is a silent agreement among financial institutions to have a ten minute session expiration time. But if your app or web app don't handle money or other sensitive information, you can use weeks instead of minutes on session expiration time.

3
  • Thank you-- we do take payments but a lot of our site is just casual browsing. Are there ways to separate the two? For example, have session expiration kick in for the payment processing page but not for others? I know that google makes you log in again for their account pages, but not for browsing or email, even. Does this make sense? I'm trying to find a happy medium.
    – Patrick
    May 21 '13 at 18:24
  • @Patrick Interesting. I think you can apply the style of LinkedIn where you get the number of notications on your account even if you're not signed in. When you want to read the notifications (or in your case, make an order or pay for something) make your users sign in again. No one is bothered - and your users feel secure! May 21 '13 at 19:50
  • I hate what linkedin does and thats why I never use it, I just dont want to remember different passwords, IMHO. Facebook, Twitter, Gmail at least dont expire their session in client eyes, same goes for spotify and mostly all services. when user need to pay you can ask for their credentials in that moment. what you people think?
    – ncubica
    May 12 '15 at 22:58

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .