Sessions expire after 15min inactivity for financial ops

An inactivity timeout longer than 15 minutes on a financial application leaves an authenticated session open on an unattended device — a walk-up attacker can initiate a wire transfer, change account details, or exfiltrate account history without needing credentials. CWE-613 (Insufficient Session Expiration) and PCI-DSS 4.0 Req 8.2.8 both mandate short inactivity windows precisely because the attack surface is physical access, not network intrusion. NIST 800-63B also ties session lifetimes to assurance level — higher-value operations demand shorter windows. A 30-minute timeout means every unlocked laptop in a coffee shop is a potential account takeover waiting for an opportunist.

Set the inactivity timeout to 900000ms in src/middleware.ts or src/lib/session.ts and enable rolling reset on each request:

session({
  cookie: { maxAge: 15 * 60 * 1000 }, // 900000ms — 15 minutes
  rolling: true,   // reset window on each request
  resave: false,
  saveUninitialized: false
})

For route-specific enforcement on high-value paths, wrap them individually:

app.use('/api/transfer', sessionTimeout(15 * 60 * 1000));

Verify the value is no more than 900000ms — not just the session cookie maxAge, but any Redis TTL or server-side store expiry as well.