Definition
A session timeout is a security feature that automatically disconnects you from a website or app if you log in and then do nothing for a set amount of time. It keeps other people from sneaking into your open account, and it takes some load off the server (the computer that provides the information).
Why does my banking app keep logging me out?
Imagine you're at a coffee shop with online banking open on your laptop, and you step away to use the restroom.
If the screen is still on, someone walking by could send your money somewhere else. To prevent that, you need a safety device that locks the door for you while you're away.
When you enter your ID and password and log in to a website, the server gives you a temporary entry pass called a "session." Thanks to this pass, you don't have to retype your password every time you move to a new screen.
But if you hold on to the pass and just sit there doing nothing, a timer starts. When the set time runs out, the system decides you've left your seat and tears up the pass. That is a session timeout.
Hackers who steal a forgotten pass
A session timeout doesn't only stop people from peeking at your screen.
On the internet, there are hacking techniques that secretly intercept the signals passing between you and the server. If the pass left in your browser stayed valid forever, a hacker wouldn't need your password. They could get into your account with just a copy of the pass.
This is called session hijacking. A session timeout limits how long the pass lasts, so even if its information leaks out, the time window for using it gets shorter.
By the time a hacker tries to use the stolen pass later, it's likely just a useless scrap of paper. Still, it can't stop someone who uses it right away while it's valid, so it's combined with other security measures.
A bit more precisely: two clocks
In real systems, two kinds of timeout clocks run side by side.
The first is the "idle timeout" that most of us run into. Every time you turn a page or click a button and a request goes to the server, the timer resets to the start. As long as you keep using the service, you stay logged in.
The second is the "absolute timeout": no matter how busily you click around, once the set time is up, you're forced to log in again. In financial systems and company internal networks where security matters a great deal, the connection is cut every few hours even if you never left your desk.
It also keeps the server's memory from filling up with the details of countless logged-in users, which helps the whole system run smoothly.
Common misconceptions
A session timeout means the app or website glitched and kicked you out.
It's not an error. It's a normal security feature, carefully designed to protect your personal information and your money.
Where you meet it
You leave online banking open and touch nothing for 10 minutes, and you get logged out automatically.
You pause for a long time while filling out a form on a government portal, and when you click Save, you get bounced back to the login page.
In one sentence
A session timeout is a security timer that disconnects you after a set time, so your account can't be hijacked while you're away from your seat.