Sjoerd Langkemper personal blog

Short session expiration does not help security

sjoerdlangkemper.nl 4 min read

When logged into a web application, the session does not remain valid forever. Typically, the session expires after a fixed time after login, or after the user has been idle for some time. How long should these times be?

Points

696

HN comments

419

Submissions

1

Cited by

0 commenters

Security & PrivacyWeb & Frontend2023

Related posts from the same era

Reverse engineering Ticketmaster's rotating barcodes

conduition20242,305 points714 comments details

Someone is pretending to be me

Connor Tumbleson20222,244 points383 commentscited by 3 details

Bypassing airport security via SQL injection

Ian Carroll20242,004 points440 comments details

Anyone can access deleted and private repository data on GitHub

Truffle Security Blog20241,983 points374 commentscited by 8 details

In 2024, please switch to Firefox

Roy Tanck20231,776 points810 comments details

Thanks FedEx, this is why we keep getting phished

Troy Hunt20241,723 points646 commentscited by 4 details