Work out session timeout policy instantly with clear inputs, formula shown and shareable results.
Two timeouts are needed. The idle timeout bounds how long an unattended session on a shared machine remains usable, and OWASP suggests 15 to 30 minutes for sensitive applications. The absolute timeout caps total session lifetime regardless of activity, which limits the value of a stolen session cookie that the attacker keeps alive with periodic requests.
Session timeout policy
hijack window = idle timeout; forced re-authentication interval = absolute timeout; recommended idle = 15 min high, 30 min medium, 60 min low sensitivity
An attacker with a stolen cookie can keep the session alive indefinitely by sending traffic. Only an absolute lifetime forces re-authentication.
MFA protects login, not an already-established session. Session theft through XSS or a shared machine bypasses it entirely, so timeouts still matter.