Increase timeout for login to Document Tracking and Home page when MFA is enabled

Hi Nancy,

Thank you for submitting this idea! I appreciate you taking the time to share your experience with the session timeout behavior when using MFA.

Understanding Your Experience

I understand the frustration of having to re-authenticate multiple times throughout the day, especially when you're already using MFA for enhanced security. The current session timeout is designed with security in mind, but I recognize that for users who have already added an extra layer of protection through MFA, the frequent re-authentication can impact productivity.

Current Behavior

Currently, Sterling B2B Integration SaaS uses a standard session timeout policy that applies uniformly across all users, regardless of their authentication method. This is a common security practice, but you raise a valid point about potentially adjusting this for MFA-enabled users.

Considerations

Your suggestion touches on an interesting security vs. usability balance:

Security Perspective:

• Session timeouts help protect against unauthorized access if a user steps away from their workstation

• Even with MFA at login, an active session could be compromised if left unattended

• Industry best practices typically recommend session timeouts regardless of authentication method

Usability Perspective:

• MFA does provide strong authentication assurance at login time

• Frequent re-authentication disrupts workflow, especially for users who access the system intermittently throughout the day

• Some organizations do implement longer session timeouts for MFA-authenticated users

Questions to Help Us Understand Better

1. Current Timeout Duration: Approximately how long does your session stay active before timing out? (e.g., 15 minutes, 30 minutes, 1 hour?)

2. Desired Duration: What would be an ideal session timeout for your workflow? (e.g., 2 hours, 4 hours, 8 hours?)

3. Usage Pattern: How frequently do you typically access the system throughout the day? (e.g., every 15 minutes, every hour, sporadically?)

4. Security Policies: Does Lifetime Brands have any internal security policies regarding session timeouts that we should be aware of?

5. "Remember Me" Option: Would a "Remember this device" option (that extends the session for trusted devices) be helpful, or do you prefer the session timeout to be universally longer for MFA users?

Potential Solutions

We could explore several approaches:

1. Extended Timeout for MFA Users: Increase session timeout (e.g., from 30 minutes to 2 hours) for users authenticated via MFA

2. Configurable Timeout: Allow administrators to configure session timeout policies based on authentication method

3. Activity-Based Extension: Extend the session automatically when there's active user interaction (similar to "keep-alive" behavior)

4. Trusted Device Option: Allow users to mark devices as "trusted" for extended sessions after MFA authentication

Next Steps

Given that this is marked as "Low" priority and "Not sure -- Just thought it was cool," I want to understand if this is becoming a significant pain point or more of a nice-to-have improvement.

• If this is impacting your daily productivity significantly, please let me know and we can prioritize it higher

• If it's a minor inconvenience, we can track it as a usability enhancement for a future release

I'd also like to understand if other users at Lifetime Brands (or other customers) are experiencing the same issue. If you could help us gather feedback from your team, that would be valuable.

.How You Can Help

1. Provide Specifics: Answer the questions above about current vs. desired timeout duration

2. Gather Feedback: Check with other users at Lifetime Brands to see if they experience the same issue

3. Security Review: Confirm with your security team that extended timeouts for MFA users would be acceptable under your policies

Thank you for bringing this to our attention. Even "low priority" ideas that improve daily usability are important to us!

Best regards,
Manoj Panda
Product Manager, Sterling B2B Integration SaaS