title: How reauthentication is handled in current modern web application
body: <p>In our web application, when a user logs in, if the session is idle for longer than 15 minutes, the user has to enter the login credentials again to continue.  </p>
  
  <p>As I do not use other web applications I would like to ask the following questions concerning this matter:  </p>
  
  <p>Is such a reauthentication usual in current web applications?</p>
  
  <p>After how many minutes inactivity does it come?  </p>
  
  <p>From a security standpoint, is it common and reasonable to only ask for the password (and not the user name again)?</p>
  
  <p>If you fail to reauthenticate (3 times), is it more common to only end the session or lock the whole account?</p>
  
  <p>Thanks alot in advance</p>