The 15-to-30-minute idle timeout is one of the most familiar conventions in application security. Its logic is straightforward: if a session goes quiet, the human probably left. Kill the session before someone else sits down.

OWASP's testing guide spells out the scenario plainly. A public computer, a user who forgot to log out, an attacker who presses the back button. The entire control is a proxy for physical presence. If the session is quiet, nobody's at the keyboard.

OWASP's own session management cheat sheet documents the gap, though: if something keeps generating requests, the timer resets and the timeout never fires. They wrote that about session hijackers. It also describes every web agent ever deployed. An agent conducting a multi-step workflow produces activity continuously. It has no idle state.

So the timeout was never really measuring intent or authorization. It was measuring whether someone was still physically sitting at a desk, which is the one thing a machine will never stop doing.