salesforce_security_impl_guide

Configuring Salesforce Security Features
Setting Session Security
Setting Session Security
You can modify session security settings to specify connection type, timeout settings, and more.
1. From Setup, click Security Controls > Session Settings.
2. Customize the session security settings.
Field
Timeout value
Disable session timeout
warning popup
Description
Length of time after which the system logs out inactive
users. For Portal users, the timeout is between 10
minutes and 12 hours even though you can only set it
as low as 15 minutes. Select a value between 15 minutes
and 12 hours. Choose a shorter timeout period if your
organization has sensitive information and you want
to enforce stricter security.
Note: The last active session time value isn’t
updated until halfway through the timeout
period. That is, if you have a 30 minute timeout,
the system won’t check for activity until 15
minutes have passed. For example, assume you
have a 30 minute timeout value. If you update
a record after 10 minutes, the last active session
time value won’t be updated because there was
no activity after 15 minutes. You’ll be logged out
in 20 more minutes (30 minutes total) because
the last active session time wasn’t updated.
Suppose you update a record after 20 minutes.
That’s five minutes after the last active session
time is checked, so your timeout resets and you
have another 30 minutes before being logged
out, for a total of 50 minutes.
Determines whether the system prompts inactive users
with a timeout warning message. Users are prompted
30 seconds before timeout as specified by the
Timeout value .
EDITIONS
The Login IP Ranges
setting is available in:
Personal, Contact
Manager, Group,
Professional, and
Database.com Editions
(Valid IP addresses can be
set at the profile level for
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions)
The Lock sessions to
the IP address from
which they
originated setting is
available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
All other settings available
in: Personal, Contact
Manager, Group,
Professional, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To set session security:
• “Customize Application”
Force logout on session
timeout
Requires that when sessions time out for inactive users,
current sessions become invalid. Browsers are
automatically refreshed and return to the login page.
To access the organization again when this occurs, users
must log in again.
Note: Do not select Disable session
timeout warning popup when enabling
this option.
83