August 17, 2024 - Security and Privacy

Design session expiration around risk and usability

Session expiry should reflect the sensitivity of the task and the way customers work. Define idle and absolute limits, protect unfinished work deliberately, and verify that the server refuses an expired session even when browser scripts fail.