Session timeout
The rule that ends a login after enough time passes, counted either from the last action (idle) or from sign-in (absolute).
See it
What it is
There are two clocks and a good app runs both. Idle timeout ends the session after N minutes with no activity, which protects the laptop left open in a cafe. Absolute timeout ends it N days after sign-in no matter how busy the user has been, which caps how long a stolen cookie is worth anything. Sliding expiry (every request pushes the idle clock forward) is the common default, and the absolute lifetime is the backstop most teams forget to add.
Pick the numbers by blast radius, not by taste: 15 to 30 minutes idle for admin consoles and anything touching money, several hours for internal tools, weeks with an explicit 'remember me' for consumer apps where surprise logouts are the top support complaint. The modern compromise is a short access token (5 to 15 minutes) plus a long-lived refresh token, so the person feels logged in for weeks while the credential presented on every request stays short-lived. Be honest about the other half of that trade: the refresh token is deliberately long-lived and can mint fresh access tokens for as long as it survives, so it needs stronger storage, rotation, a bounded lifetime, inactivity expiry, and a working revocation path.
The gotcha is entirely a UX one: expiring the server session without telling the client produces the worst bug in this genre, the form submit that silently eats an hour of writing. Warn a minute or two before expiry with a 'still there?' prompt and a way to extend, keep drafts in local storage, and return a 401 the client can act on by redirecting to login with a return URL. Also keep cookie Max-Age and server-side expiry in sync, because when they disagree one of them is lying to you.
Ask AI for it
Add both idle and absolute session expiry to this app's session handling. Store expires_at (idle deadline) and absolute_expires_at on each session row. Default the idle window to 30 minutes and the absolute lifetime to 7 days, or 30 days when the user checked 'remember me', and read all four numbers from config rather than hardcoding them. On each authenticated request, reject the session if either deadline has passed, otherwise slide the idle deadline forward (throttled to one write per minute). Never extend the absolute deadline. Expose the remaining idle time to the client and show a modal 2 minutes before expiry offering 'stay signed in', which calls a refresh endpoint. On expiry, return 401 with a machine-readable reason, redirect to login with a returnTo parameter, and preserve unsaved form input in local storage so nothing is lost.