Sessions expire after ≤30min inactivity; re-auth for sensitive ops

Indefinite sessions leave authenticated tokens valid on shared or stolen devices long after the user leaves — a session cookie captured from an unattended workstation grants full account access with no expiry. NIST 800-53 rev5 AC-12 (Session Termination) requires automatic logout after inactivity, and AC-11 mandates re-authentication before sensitive operations. CWE-613 (Insufficient Session Expiration) and OWASP A07 both cite missing session timeouts as enabling session hijacking attacks. Federal system guidance caps inactivity timeout at 30 minutes; operations like password changes require step-up authentication even within an active session.

Set maxAge to 1800 seconds in your auth library config and require current-password re-verification before sensitive operations like password changes or account deletion.

// lib/auth.ts (next-auth)
export const { handlers, auth } = NextAuth({
  session: {
    strategy: 'jwt',
    maxAge: 30 * 60,       // 30 minutes absolute expiry
    updateAge: 5 * 60      // slide the window every 5 minutes of activity
  }
})

// app/api/account/delete/route.ts
export const POST = async (req: Request) => {
  const session = await auth()
  const { currentPassword } = await req.json()
  const user = await db.user.findUnique({ where: { id: session!.user.id } })
  const ok = await bcrypt.compare(currentPassword, user!.passwordHash)
  if (!ok) return Response.json({ error: 'Re-authentication required' }, { status: 401 })
  // proceed with deletion
}

For Supabase Auth, set SUPABASE_AUTH_JWT_EXPIRY to 1800. Clerk and Auth0 both expose session lifetime controls in their dashboard settings.