[thelist] login/logout

[aardvark]

> From: Scott Dexter <sgd at ti3.com>
>
> We use 20 minutes (between page views) as our default and tune to
> application/client; though if you are using cookies, you can not set an
> expire date, and the cookies (and thusly the session) are killed when the
> browser is closed....

i tend to use 10 minutes as my baseline, and then modify it 
depending on client, users, servers, etc...

i also try to tell users what that time frame is... for instance, on one 
of my e-comm sites, next to the link to continue shopping, i have 
the text "We'll remember what you have in your cart for 10 
minutes."

i guess it depends on how "secure" the session info is (if the user 
walks away, is it bad if someone sits down and takes over his/her 
session?) and what you're trying to do...