Design Session Timeout and Expiry

Trust, Privacy & Ethics · authentication, security, errors

Updated 2026-07-28

Never let a timeout destroy work. Expiring in the middle of a long form is the moment most users lose trust in a product permanently.
Warn before it happens, with enough time to react and a clear way to stay signed in. A countdown that appears with ten seconds left is a notification, not a choice.
Keep the draft locally when a session does expire, and restore it after signing back in so the user continues rather than restarts.
Return the user to where they were. After re-authenticating, the correct destination is the page they were on with their state intact, not the dashboard.
Match the timeout to the risk. A banking session and a note-taking app should not have the same policy, and neither should be inherited from a framework default.
Distinguish an expired session from a permission change. Being signed out and being no longer allowed are different problems with different messages.
Handle the background tab. A page left open for hours should recover gracefully on return rather than presenting broken data or silent failures.
Do not sign the user out of every device unless they asked. Ending one session should not disrupt the others without an explicit action.

Security timeouts are a legitimate requirement, and losing the user's work is not part of that requirement.