In financial Android apps, setting up local session timeouts is essential to prevent unauthorized access if a user leaves the app unattended. With a session timeout, the app automatically logs the user out after a certain period of inactivity, adding a layer of security to protect sensitive data.

In this blog, I’ll walk you through:

• What a local session timeout is
• Why session timeouts are crucial for financial apps
• How to implement a session timeout in Kotlin with step-by-step code
• Best practices for managing session timeouts effectively

Let’s dive into how you can secure your app and enhance user trust by setting up session timeouts the right way.

What is a Local Session Timeout?

A local session timeout is a security feature that helps keep user data safe by tracking inactivity. If a user hasn’t interacted with the app for a set amount of time, the app will automatically log them out. This feature is especially important in financial apps, where protecting sensitive information is a top priority.

Why Local Session Timeout is Important for Financial Apps

In financial apps, leaving a session open can be a serious security risk. If someone else picks up the user’s phone, they could access the app and potentially perform unauthorized actions. By adding a session timeout, we:

• Reduce the risk of unauthorized access,
• Safeguard sensitive financial data, and
• Ensure compliance with security standards in the financial industry.

How to Set Up a Local Session Timeout

Here’s how to add a local session timeout feature to an Android app using Kotlin. We’ll take it step-by-step:

1. Define the Inactivity Timeout Duration — Decide how long the app should remain active without user interaction.
2. Track User Activity — Monitor interactions like touches, scrolls, or button presses to keep track of activity.
3. Reset the Timer — Each time the user interacts with the app, reset the timer to give them more active time.
4. Handle the Timeout — If no activity is detected within the specified time, log the user out automatically.

Step-by-Step Implementation in Kotlin

Step 1: Set Up Constants

First, let’s define a constant for our timeout duration. For example, we might want a timeout of 5 minutes.

const val TIMEOUT_DURATION = 5 * 60 * 1000L // 5 minutes in milliseconds

Step 2: Create a SessionManager Class

Next, let’s create a SessionManager class to handle the session tracking and timeout. This class will manage a timer that resets every time the user interacts with the app.

class SessionManager(private val context: Context) {

    private var timer: CountDownTimer? = null

    // Start or restart the inactivity timer
    fun startSessionTimeout() {
        timer?.cancel() // cancel any existing timer
        timer = object : CountDownTimer(TIMEOUT_DURATION, 1000L) {
            override fun onTick(millisUntilFinished: Long) {
                // Optionally, add logging or other feedback here
            }

            override fun onFinish() {
                onSessionTimeout()
            }
        }.start()
    }

    // Reset the timer on user interaction
    fun resetSessionTimeout() {
        startSessionTimeout()
    }

    // Handle session timeout (e.g., log the user out)
    private fun onSessionTimeout() {
        // Example action: Redirect to login screen
        context.startActivity(Intent(context, LoginActivity::class.java).apply {
            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK
        })
    }

    // Cancel the timer when the session ends
    fun endSession() {
        timer?.cancel()
    }
}

• startSessionTimeout: Starts or restarts a countdown timer. If there’s no activity, onFinish() calls onSessionTimeout().
• resetSessionTimeout: Resets the timer whenever the user interacts with the app.
• onSessionTimeout: This function defines what happens when the timer expires. Here, we’re redirecting the user to the login screen.
• endSession: Cancels the timer when the session ends, helping save resources.

Step 3: Integrate Session Timeout in the Main Activity

In your main activity, you’ll initialize SessionManager and handle user interactions to keep the timer updated.

class MainActivity : AppCompatActivity() {

    private lateinit var sessionManager: SessionManager

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)

        sessionManager = SessionManager(this)

        // Start the session timer when the activity is created
        sessionManager.startSessionTimeout()
    }

    override fun onUserInteraction() {
        super.onUserInteraction()
        // Reset the session timeout on any user interaction
        sessionManager.resetSessionTimeout()
    }

    override fun onDestroy() {
        super.onDestroy()
        // End the session when the activity is destroyed
        sessionManager.endSession()
    }
}

• onUserInteraction: This built-in method is called whenever the user interacts with the app (touch, scroll, etc.). We’re using it to reset the session timeout.
• onDestroy: Stops the timer if the activity is destroyed, which helps save resources.

Step 4: Add Login Handling (Optional)

Redirecting the user to the login screen upon timeout adds an extra layer of protection for sensitive data. Assuming you have a LoginActivity set up, the SessionManager class will send users there if their session times out.

Best Practices for Session Timeout in Financial Apps

• Choose a Practical Timeout Duration: For financial apps, a timeout of 5 to 10 minutes of inactivity is generally a good choice. It strikes the right balance between keeping data secure and not being too disruptive for the user.
• Notify the User Before Logging Out: Many apps show a quick warning dialog just before logging out. This gives users a chance to stay logged in by interacting with the app, making the experience smoother and reducing unexpected logouts.
• Handle Background State Changes Carefully: If the user switches to another app or the app moves to the background, consider starting the timeout timer or even logging out immediately. This reduces the risk of leaving sensitive data open if the app isn’t actively being used.

Conclusion

Implementing session timeouts in financial apps is essential for protecting user data. I’ve shared how using Kotlin and Android’s CountDownTimer makes it simple to set up a reliable timeout system. By choosing a practical timeout duration, notifying users before logout, and handling background state changes, we can ensure that our apps are both secure and user-friendly.

As developers, it’s our job to safeguard sensitive information while making sure the app remains intuitive. With these steps in place, you’ll be able to create a financial app that balances both security and a smooth user experience. Keep iterating and refining—this approach will help you build a stronger, safer app over time.