Library session settings
Session settings control inactivity timeouts and warning behaviour for end users across the library. Saving them publishes the shared policy to all available environments, including Production, after confirmation.
Open the library, select Library settings, then Session settings.
Understand the two durations
| Setting | Behaviour |
|---|---|
| Session timeout | Signs the user out after the configured number of minutes without activity. |
| Timeout warning display duration | For an anonymous service, controls how long the warning is shown before the session expires and unsaved data is lost. |
For a signed-in service, changes on the current page are saved in the background and restored after the person signs back in. For an anonymous service, the warning dialog explains that expiry will lose the session’s data. These behaviours make it essential to test both service access models rather than assuming one timeout experience.
Choose a proportionate timeout
Balance the sensitivity of the service, use on shared devices and the realistic time needed to complete a page. A very short timeout can exclude people who need more time to read, gather evidence or use assistive technology. A very long timeout can expose data on an unattended device.
Consider:
- the longest page or document-review task;
- whether users must leave the service to find information;
- shared-device and kiosk use;
- the sensitivity of displayed and entered data;
- save-and-return behaviour for signed-in users;
- support guidance after expiry.
The warning must last long enough for a person to understand it and choose to continue. Test with keyboard navigation and a screen reader, not only with a pointer.
Test the complete expiry path
- Use a service-specific timeout override in a QA-deployed service to test a proposed duration before changing the shared library policy.
- Start a signed-in journey, change an answer and wait for expiry.
- Sign in again and confirm the current-page change is restored as intended.
- Repeat with an anonymous service and confirm the warning appears at the expected time.
- Allow the anonymous session to expire and check that the message and recovery route are clear.
- Choose to continue from the warning and confirm the timer is renewed.
- Check long pages, uploads and assistive-technology use.
Do not run a timeout test with real personal data in QA.
Apply the setting
Select Save and review the confirmation that applies the settings to all available environments, including Production. Check the environment statuses after confirming. This page no longer has a separate QA-only Apply operation.
A service timeout override takes precedence over the library default. The anonymous warning duration is in seconds and defaults to 180; the inactivity timeout is in minutes. Coordinate a live reduction with service owners and support teams. See Shared settings publication.