What are best practices when setting session expiration for a site's login?

1. What is the recommended security setting for session timeout?
2. What is a reasonable session timeout?
3. Why do login sessions expire?
4. How do you implement session timeout?

What is the recommended security setting for session timeout?

Configure Session Timeout Settings

For portal users, even though the actual timeout is between 10 minutes and 24 hours, you can only select a value between 15 minutes and 24 hours. If you want to enforce stricter security for sensitive information, choose a shorter timeout period.

What is a reasonable session timeout?

Common idle timeouts ranges are 2-5 minutes for high-value applications and 15- 30 minutes for low risk applications.”

Why do login sessions expire?

If your Internet connection is unstable, periodically disconnecting and reconnecting, it can cause a website session to expire. When the Internet connection is lost the website connection can be terminated, resulting in a session expired message if you try to access any page after the Internet reconnects.

How do you implement session timeout?

Select System administration > Setup > System parameters to open the System parameters page. On the General tab, in the Session management section, enter a value in the Session inactivity timeout in minutes field. Select Save. If you set the value to greater than 30, you will be prompted to confirm your selection.