How long should you let a user stay signed in for on a web application?

Question

Background to question: We are building an online web application that requires the user to sign in. We will add the ability to "keep me signed in on this computer for x weeks."

Question:

What is the normal standard for how long you should allow a user to stay signed in for? * 2 weeks? * 4 weeks? * Forever?

And why? Is there a reason that we should not allow our users to stay signed in forever?

Answer 1

I don't know if there is a standard, really. It all depends on your application and security concerns. You don't want just anybody to be able to sit down at your computer and grab your credit card number while you're still logged in.

But Stackoverflow, for example, doesn't have the highest security concern regarding logins and it shouldn't. It's a big convenience that I don't have to sign in here for every visit.

On the other hand, my job involves developing & supporting a large online insurance application. It's a little more important that I keep it secure as we gather a lot of personal information. Of course, we don't gather credit card or social security numbers and we certainly don't want the login to time out in the middle of an application. So we went with a compromise of a 12 hour timeout tied to a session. This means that closing the browser has the effect of automatically logging out, or if you let the browser sit on the site for 12 hours you're logged out that way too.

And then at the far end of the spectrum you have your online banking sites which typically sign you out after about 20 minutes. This makes perfect sense as I can't think of a worse case scenario than somebody stealing all of my money all because online banking kept me logged in too long.