Abstract: Exemplary methods for performing session timeout include periodically receiving a first plurality of client requests corresponding to the first user session from a client, the client requests including a request time indicating a time when a corresponding client request was transmitted by the client, and a user active time indicating a time when a user last accessed the server via the first user session as of the time when the corresponding client request was transmitted by the client. In one embodiment, the method includes determining whether the first user session has timed out based on one or more request time and one or more user active time included the one or more client requests of the first plurality of client requests. In one embodiment, the method includes in response to determining the first user session has timed out, terminating the first user session and the SSO session.