Time Out, Close Session and Reauthentication Timing

Hi all-

I have a question about length of time for time outs, closing sessions and
reauthentication timing for web (browser) based applications.

We are currently experiencing unacceptably short time outs in our
applications and need to establish some standards.  Our applications are
medium security - they don't deal with state secrets - but do handle all
documentation (sometimes very sensitive) for companies.

Does anyone have any examples or standards for when a user should be timed
out on an app, when the session should close, and when reauthentication is
required and to what state it returns the user (i.e. back to exactly where
you were as in ctl-alt-delete on a pc, or back to the beginning).

Just to keep things clear I've included the definitions I got from my
engineering partner on the above terms:

A timeout is an engineering invention to help solve the problem of not being
able to tell when a session has finished.  A system can decide to terminate
a session after a preset amount of time has passed since a previous event.
There are generally two types of timeout:

   1. Inactivity timeout – a set amount of time since the last request
   2. Credential timeout – a set amount of time since the credentials
   were issued

Once a timeout has occurred, there are generally two ways to proceed if the
user submits a new request:

   1. Allow the user to "reauthenticate" (resubmit user name and password
   information), and then continue the previous session
   2. Prompt for a new login, and start a new session

The reauthentication process can allow a user to continue a task that was
interrupted.

A "session" is a series of related interactions between a web browser and a
web server.  The telecommunications channels used by the web browser to make
requests are typically very short lived (i.e. less than 5 seconds), while a
session may take place over minutes or hours.
While the beginning of a session is easily defined by the initial web
request, the end of a session is not well defined, since there is no single
event that can be relied on to signal that a user is finished with
interactions.




As always...thanks in advance for your help!

-deb brown

    --------------------------------------------------------------
    Tip of the Day: Quote only what you need from earlier postings
     CHI-WEB: www.sigchi.org/web POSTINGS: mailto:[email protected]
              MODERATORS: mailto:[email protected]
       SUBSCRIPTION CHANGES & FAQ:  www.sigchi.org/web/faq.html
    --------------------------------------------------------------