Web Security · Middle · Question 47 of 75

Which session timeouts are recommended?

1No timeout at all, for convenience
✓Correct answer: An idle timeout plus an absolute lifetime, both enforced on the server
3Only a timer in the front end that hides the UI

Explanation

Client-side timers can be bypassed. The server must reject expired sessions; sensitive apps use shorter timeouts.

Further reading

OWASP: Session Management Cheat Sheet ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.