Should a mobile application force login after terminating app?
I've been working on a mobile application which utilizes sessions. Recently I noticed our mobile application does not force the user to login after the user terminates the application.
For example, in iOS if the user terminates an application by pressing the home button twice and swiping-up the application, then re-opens that application it will not force the user to log back in again.
Would you expect to login after the app is terminated?
or does the apps ability to check your session and let you in, just a undocumented "feature"?
I would expect the undocumented "feature" to be a security flaw, because someone can pickup my phone and have access to an application that normally requires login. I agree that if the application is going to the background that it shouldn't log the user off, but if I kill the app it should force me to login again.