We have a website that automatically logs the user out if they have been idle for an hour, saying Session has timed out for security purposes.

Can this kind of test be automated? If automated through UI automation tools like Selenium, would you write a script to wait for an hour to validate the session timed-out message? But this would make the execution time at least one hour, which is too long.

Just wanted to know the best way to automate this scenario or if it should be added under No plans to automate tests.

  • 1
    What part of the functionality are you wanting to test here? Is it testing the user is automatically logged out, or that it takes an hour for the user to be idle before logging them out?
    – Swagin9
    Commented Nov 21, 2016 at 19:27
  • Automation should be fast.See if you have an alternative, like for example to reset the session and then to navigate to a certain page like account.If you can have a test tat executes fast then yes, else no.
    – lauda
    Commented Nov 24, 2016 at 9:16
  • 2
    It depends on how your session is managed. One could change expiration date of a cookie, make an API call to invalidate the current session, or delete/modify some value in local storage, just to name a few options.
    – kirbycope
    Commented Dec 5, 2016 at 18:08
  • I believe that we should be able to test such cases without waiting for the full duration. To achieve this, developers should make the app "easily testable". That is, make it so that a tester can trigger a timeout whenever he needs, and the app should trigger the timeout in the same way. This must be done without creating any security problems. In one test, I had to check if a popup came after timeout. I simply called a function in the browser console to cause an instant timeout, rather than waiting several minutes. I don't know how this could be automated though.
    – MasterJoe
    Commented Feb 14, 2019 at 1:19

4 Answers 4


My scripts run overnight, where 1 hour isn't too much.

Incidentally, you have to test that your session doesn't time out until the desired amount of time has elapsed.

So in your case, my script would wait 59 minutes and check that the session hasn't timed out. Then it would wait 60 minutes to check that the session has timed out and that the appropriate action and messages occur.

For many sites, the timeout value is set in a configuration somewhere. So on your test site, you may be better served to set your timeout value to something short (5 minutes?). You are testing the functionality that way. In production, you will still need to check that the configuration has been set up properly (to 1 hour, for example).

  • Joe, please see my comment after the question. I believe that the app should be developed such that a tester can easily trigger the timeout when he desires. The app should do it the same way. What do you think ?
    – MasterJoe
    Commented Feb 14, 2019 at 1:21
  • Alternately, should we make the developer test this with a low timeout instead of making the QA do it because he might have better control over the application settings ?
    – MasterJoe
    Commented Feb 14, 2019 at 1:26

Is the best way to automate this is via the UI?

Could you use a combination of unit and integration tests to test the backend api and the exploratory/manual testing to ensure the pop-up appears?

Alternatively, if the business needs it to be automated via the UI, you can always configure the time out to be less than an hour so you're not waiting an entire hour for the test?

Then the question is: what is it you're testing? Are you testing that the user is logged out or are you testing that the message appears? There are multiple ways for this to be tested using Selenium.


Whether this timeout session testing should be automated is up to you and other stakeholders.

  1. Is it worth doing an automated test case to test timeout? E.g. does it provide any gain in doing it?
  2. This scenario is easily accomplished by manual testing and the code in the back end is not very complicated (I would hope). So it makes sense to manual test it.
  3. If you decide to automate it, waiting for one hour will not be an issue as a computer is doing the work; and you can configure this test to be executed out of office hours to save time.

When trying to automate a time sensitive test a common approach is to use a tool to adjust the local time that the test is using.

So in this case you would record or set a time, then advance the local time 1 hour then observe the results.

For example when using Ruby, a frequent choice is the Timecop Gem:


  • I don't understand what you are doing. Say I have a website where timeout should occur after 15 minutes of inactivity. Changing my timezone in the app or even on my computer will not cause a timeout.
    – MasterJoe
    Commented Feb 14, 2019 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.