Upon Session Timeout, immediately redirect the user to the login screen.

After session timeout, the last open page is still visible instead of redirecting to the login screen to protect sensitive data.

• • The application should redirect a user whose session has expired to the log off page so the user session will be invalidated properly. An example of JavaScript to perform the redirect is below.

  • This code should be included on all navigable pages, i.e. all pages in the main frame.setTimeout("top.location.href='logout.html'", 900000 );