It's 10 seconds or less Anyhow, as indirect answer, you should expect users getting really annoyed after 10 seconds. See this famous post for more.
How long should my request timeout be?
The default value is 120 seconds. This stanza entry affects request and response data sent as two or more fragments. The stanza entry specifies the timeout (in seconds) between each request data fragment after the first data fragment is received by WebSEAL.
What does 408 forbidden mean?
The HyperText Transfer Protocol (HTTP) 408 Request Timeout response status code means that the server would like to shut down this unused connection. It is sent on an idle connection by some servers, even without any previous request by the client.