Session expiry is configured with a reasonable timeout

A session with no expiry or a 90-day timeout hands attackers an indefinitely valid credential from a single stolen cookie. NIST 800-63B §7.2 and PCI-DSS Req-8.2.8 both require session termination after a defined inactivity period — for good reason. A user who forgets to log out on a shared machine, or whose cookie is skimmed from an insecure connection, can have their account accessed for weeks or months with no recourse. OWASP A07 specifically lists insufficient session expiration as an authentication failure vector.

Set an explicit session lifetime rather than relying on a framework default that may be undocumented. For general SaaS, 7 days is a reasonable balance between security and UX; for finance or health apps, use 24 hours or less:

// NextAuth example in authOptions
session: {
  strategy: 'jwt',
  maxAge: 7 * 24 * 60 * 60, // 7 days
  updateAge: 24 * 60 * 60,  // extend on activity
}

Pair short session lifetimes with refresh token rotation so active users are not logged out while dormant sessions are expired.