You can also set a timeout on the client. Some sites do, some sites don’t. If you want to, you’d take the timestamp from the session and generate some javascript to trigger a function after a timeout. To extend the timeout, you can just update the session value on user action.