Insufficient Session Timeout Value

This weakness may improve the likely success of certain attacks. For example, an attacker may intercept a session ID, possibly via a network sniffer or Cross-site Scripting attack. Although short session expiration times do not help if a stolen token is immediately used, they will protect against ongoing replaying of the session ID. In another scenario, a user might access a web site from a shared computer (such as at a library, Internet cafe, or open work environment), but forget to close the pages before leaving. A long expiration could allow an attacker to use the browser's back button to access web pages previously accessed by the victim.