What are the best practices for session timeout and expiration?

So i'm just working on this! Doing a NextJS site for a Cannabis dispensary in NYC. There is a strict age-gate for users, and they must acknowledge being above 21 to access the site. And while we want to keep that session valid, from an e-commerce (making sales perspective), we also don't want underage users accessing the computer following their older sibling, and being able to venture off into a cannabis site, when they should not. To ensure compliance, I am using cookies, a general session timeout and as token granted within local storage. I thought this was super interesting because its such a new age decision we have to make, with cannabis becoming legal. We ended up going with 30 minutes to one hour, for not logged in users.

On the contrary,short timeout period impacts accessibility of application when users with ADHD or vision impairment need little more time to navigate through! Having a balance between active session management and option to extend active session is critical

Session timeout warning and notifications which are to be watched to give enough time on visual hint for customers either to extend or end the session. SESSION extension warnings as overlays are often blocked by Adblockers in web browsers hence we need to be mindful about mode of display. Similarly session cookies are the key source of information for hackers. Session cookie management should be reviewed at the end of every active session to let the user retain or delete cookies in local

Session timeout and token expiry are sometimes two separate things. For example, the system may throw you back from the interface to the login screen, but the session token you have used up to that point can still be used and operations can still be performed on behalf of the user. This is a serious bug that should be checked in vulnerability scans.

To test session timeout and expiration, use web proxies, browser extensions, and automated scanners. Web proxies can intercept and modify HTTP requests to capture and replay session IDs. Browser extensions allow viewing, editing, or deleting session IDs stored in cookies or local storage. Automated scanners check for issues like weak session IDs and improper termination. At White Internet Consulting, using these tools revealed a session fixation vulnerability in a client's application. My advice: regularly monitor and manipulate session IDs to ensure robust session management. This proactive approach helps identify and mitigate potential security risks effectively.

I have written scripts in wdio which wait for a couple of minutes until the alert appears to warn the user on timeouts. But challenges with the latest modernised UI are that not all the ReactJS page of applications follow track of activity and it may even break as a timeout to actual authentication to user while user still accessing small section of page without realising that his entries will get vanished(since authentication token of active session expired);

Session timeout and expiration vary depending on the context and have to be balanced with the user-experience, but in any doubts it's always a good strategy to check for standards like in that particular case that applies NIST 800-63 and OWASP ASVS.

When timeout not forced at server side, Man in the Middle attack possible when user session get hijacked on hidden tracking tools such as BurpSuite and both header,body gets modified during request and response hence user credentials get traced,amended and used as a threat to whole user journey!

In my experience, the appropriate session timeout for web applications should depend on the sensitivity of the data. For highly sensitive applications, a timeout of 5 to 15 minutes is advisable to enhance security. Applications with less sensitive data can have a longer timeout of 15 to 30 minutes. Crucially, after session expiry, the session token should be completely invalidated to prevent further use. Additionally, all client-side storage like cookies, session storage, and local storage must be cleared, and the user should be redirected to the login page with a message indicating that their session has been closed due to inactivity.

Improving session management skills as a software tester involves actively participating in testing sessions, gaining exposure to various testing techniques, and seeking feedback from peers and mentors. Practice scenario-based testing to enhance critical thinking and problem-solving abilities, while also focusing on effective communication and collaboration with team members. Stay updated on industry trends and best practices through continuous learning and professional development. Regularly reflect on testing experiences and identify areas for improvement, striving to refine session management techniques and strategies over time.

Learn to adapt interceptor mode of Burpsuite professional or Fiddler's transaction tracker to trace each HTTP request to amend the requests before they get posted to server-these advanced interceptions need a strong monitoring through threat detecting tools such as ThreatMetrix and Biocatch to block such linked IPs.