Had a request from Infosec to enforce a 15 min session timeout. Have configured it on the org-wide settings, have additionally configured it on the profile level. Still, after 15 mins, test user can happily continue to work in Salesforce.

What else could I be missing in enforcing this timeout?

  • did you enable "Force logout on session timeout" Session Security Settings
    – glls
    Aug 7, 2017 at 13:46
  • Also worth checking: View and Edit Session Timeout Settings in Profiles
    – glls
    Aug 7, 2017 at 13:47
  • Yes, force logout is enabled
    – Rob Cowell
    Aug 7, 2017 at 13:51
  • 1
    maybe an installed package is keeping the users session active? (via requests or something?)
    – glls
    Aug 7, 2017 at 13:54
  • 1
    for starters, you can check the users browser console, see if any requests are sent while the session is active (browser dev tools)
    – glls
    Aug 7, 2017 at 14:02

1 Answer 1


Session time outs only occur when the user doesn't do anything for the specified time window. If a user is "happily working" in salesforce, they're doing something, and so they won't be timed out. If they go away for a lunch break, they should come back to find that their session has expired and they must log in again.

Note that it is possible for developers to define code that allows a session to stay active indefinitely. For example, if a developer were to put an actionPoller in a Visualforce page, and the user walked away, their Visualforce session would remain active as long as that page was open. When possible, developers should avoid writing code that may make an otherwise inactive session remain viable.

  • Yup, that's what we're expecting to see. Tester deliberately leaving browser alone for more than the specified 15 mins, then they come back to it and continue like nothing happened. Cos nothing happened.
    – Rob Cowell
    Aug 7, 2017 at 15:55
  • Re: edit relating to ActionPoller - pretty sure we don't have any, but I'll do a full metadata sweep just in case.
    – Rob Cowell
    Aug 7, 2017 at 15:56
  • 2
    @RobCowell Granted, it may not be an actionPoller (that's just an example), but consider going to the browser's "Console" (F12), and watch the Network tab for any activity.
    – sfdcfox
    Aug 7, 2017 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .