Set two timers on every remote session: an idle timeout that ends it after inactivity, and an absolute timeout that ends it after a fixed total time no matter what. OWASP and NIST give concrete ranges, and the higher the value of what the session can reach, the shorter both should be.
Two timers, two jobs
An idle timeout handles the walked-away case. Someone leaves a laptop open, or a phone unlocked on a table, and the session closes on its own.
An absolute timeout handles the stolen-token case. Even if someone keeps a session alive with activity, or an attacker replays a captured session, it ends after a set time and the user must authenticate again.
You need both. An idle timer alone can be kept alive forever. An absolute timer alone leaves a long window for the walked-away case.
What OWASP suggests
The OWASP Session Management Cheat Sheet recommends setting both timeouts for every session and enforcing them on the server. It cites common idle ranges of 2 to 5 minutes for high-value applications and 15 to 30 minutes for low-risk ones. For an absolute timeout on a full-day work application, it suggests 4 to 8 hours. It also describes an optional renewal timeout, which rotates the session identifier mid-session without ending it, useful when the absolute timeout is long.
The page is explicit that "session timeout management and expiration must be enforced server-side." A timer in the browser is only a convenience.
What NIST suggests
NIST's digital identity guidelines (SP 800-63B-4) tie reauthentication limits to assurance level. In the text I reviewed:
- At the lowest level, the overall reauthentication timeout should be no more than 30 days, and an inactivity timeout is optional.
- At the middle level, the overall timeout should be no more than 24 hours and the inactivity timeout no more than 1 hour.
- At the highest level, the overall timeout shall be no more than 12 hours and the inactivity timeout should be no more than 15 minutes.
Treat these as reference points for policy writing, and check the current published text before you cite exact numbers in a policy.
Choosing values for remote work
Match the timer to what the session can do.
- Browser sessions to a source control host or CI system. These can ship code. Use short idle timers, and an absolute limit within a working day.
- Cloud console sessions. Same reasoning, plus reauthentication before sensitive actions.
- SSH or remote shell sessions to production. Short idle timers are common, and you can pair them with keepalive settings so a dead connection is dropped. See why SSH sessions drop on mobile networks.
- Phone apps for reading alerts. The risk is lower for read only apps, so a longer idle timer is more reasonable, but keep an absolute limit.
Reauthenticate on risk, not only on time
OWASP also suggests requiring reauthentication after high-risk events such as credential changes, logins from new devices or IP addresses, and account recovery. Time based rules are a floor. Event based rules catch the odd case.
What users will accept
A timer that logs people out every ten minutes gets worked around. Two things reduce the pain.
- Use passkeys or another fast, phishing resistant sign-in, so reauthentication takes seconds. See passkeys for developer accounts.
- Use sliding idle timers with a hard absolute cap, so active work is not interrupted but nothing lives forever.
Logout must really log out
OWASP notes that deleting a cookie on the client does not stop a stolen session identifier from working. Logout must invalidate the session on the server. Test this on your own tools: sign out, then replay the old session in a private window if you can.
Quick check
Which is more important, idle or absolute timeout?
Both. Idle protects against an unattended device and absolute protects against a stolen or replayed session. Using only one leaves a gap.
Can I rely on the browser to enforce the timeout?
No. OWASP says timeouts must be enforced on the server, because a client side timer can be skipped by anyone holding the session identifier.
Sources
Last reviewed: 19 October 2026.
