At the moment when a WebAccess session times out, the browser still displays the last state of the mailbox. There is nothing on the screen that tells you that your session is dead already for hours. So you just see the screen and wait for the new messages to appear. But when you click something, a popup window ask you for username and password. Doh! WebAccess should display the initial login window when a session timeout happens. Or it should warn users before it happens. SSPR does it this way for example.

Comments