How would you respond to a complaint about a timeout issue?

[Sambora]

Hi,

I've built a web application that has been sold onto dozens of customers in the UK and Ireland. One customer is complaining about a timeout issue, but its their process to blame (the system times out after 15 minutes which gives enough opportunity to fill out a form!) but they've raised a complaint.

How do I explain in clear English that its a security feature, and that it needs to be included to pass a Pen test?

[Nepomuk]

Hi Sambora and welcome to bytes.com!

I would probably write something like "Dear customer, thank you for your message. The timeout you described is not an error but a security feature; it is assumed that if the form is not completed within 15 minutes it may have been left open by mistake. This could pose a security risk which is why the system will timeout to protect the customers data."

It's not perfect I guess (and it should be adapted to your situation) but I think something of the kind should do.

[Frinavale]

You could also consider allowing the end user to configure the time out value so that they can pick a time that they deem reasonable (within a max/min constraint that you deem reasonable of course).

I store this type of thing in the web.config file.

-Frinny