Correct length for login timeout?

The justification for login timeouts depends on the security level of your application and the how the users use the app. If your app handles financial/sensitive data, the login timeout should be short (logically), approx. 3-5 minutes. If your app is a CMS, use a longer timeout.

1. How long should session timeout be?
2. How long should login session be?
3. What is login timeout?
4. What is the session timeout?

How long should session timeout be?

Typical session timeouts are 15- to 45-minute durations depending on the sensitivity of the data that may be exposed. As the session timeout is approaching, offer users a warning and give them an opportunity to stay logged in.

How long should login session be?

It considers that longer idle time outs (15-30 minutes) are acceptable for low-risk applications. On the other hand, NIST recommends that application builders make their users re-authenticate every 12 hours and terminate sessions after 30 minutes of inactivity.

What is login timeout?

Specifies the number of seconds to wait before timing out when establishing connection. The default is 30 seconds. The corresponding adapter command is -LT (or -LOGINTIMEOUT).

What is the session timeout?

The session timeout determines the time a user can remain idle before the session is terminated and the user must log in again. The session time out includes administrators logged in through the portal service.