Session Cookie Drop-Logout at 90s Logs Out 34% Mid-Bet

A 90-second idle timeout on session cookies is logging out roughly 34% of Croatian online betting accounts while a bet is still pending, according to drop-logout telemetry shared with operators in the region. The figure is not a bonus-abuse statistic or a fraud flag — it is the share of forced logouts that fire between bet placement and bet settlement, on sessions where the user never touched the page again. At that point the wager is already committed and the balance is already debited, but the client-side session is gone.

That number matters more in Croatia than the same number would in, say, Malta or Denmark, because of how the domestic market is structured. Hrvatska lutrija holds the monopoly on sports betting under the Zakon o igrama na sreću, online casino verticals sit with a small number of licensed operators, and a large share of players reach those operators through mobile browsers rather than native apps. A browser session that dies at 90 seconds is a browser session that dies during the exact window when a player is most likely to be doing nothing at all — watching a live odds board, waiting for a VAR review, or sitting on a cash-out decision.

Where the 90-second figure comes from

The 90-second number is not a regulatory requirement. It is a default. It shows up in three places at once, which is why it propagates so cleanly across operators.

The first is the cookie consent and session framework that most Croatian-facing sites license from the same two or three vendors. Those vendors ship a session TTL of 90 seconds for "inactive" tabs as a server-cost optimisation, on the assumption that an idle tab is an abandoned tab. That assumption was reasonable for a content site in 2016. It is wrong for a bet slip.

The second is the payment-services layer. Card processors and the local banking rails that handle deposits to Croatian-licensed operators increasingly require short-lived session tokens on any page that can initiate a transaction. A 90-second token lifetime satisfies most of those requirements without triggering a second factor on every request, so it becomes the path of least resistance for a compliance team that does not want to argue with an acquirer.

The third is mobile browser behaviour itself. Chrome on Android and Safari on iOS both throttle background tabs aggressively. When a player switches to a banking app to confirm a deposit, or to WhatsApp to check a group tip, the operator's tab is frozen, the heartbeat stops, and the server-side session reaper does its job. The player comes back 40 seconds later and is logged out mid-flow.

The 34% figure comes from a sample of roughly 1.2 million forced-logout events across four Croatian-licensed operators over a 90-day window ending 31 March 2025. Of those events, 34.1% occurred on sessions with an unsettled bet. That is the specific, narrow, and expensive subset. The other 66% are the ordinary annoyances — a player reading a terms page, a player who genuinely walked away.

The distinction that gets lost

Operators tend to report "session expiry" as a single metric and then optimise the whole bucket. That is the error. A logout on a page with no open position costs you a page view. A logout on a page with an open position costs you the trust of a player who now has to decide whether the bet they placed actually exists.

In practice, the bet does exist. It is on the server, it is settled by the sportsbook engine, and the money moves correctly. The problem is that the player cannot see it. And a player who cannot see their open bet for 90 seconds will often assume the worst, contact support, or — worse — place the same bet again on a different market once they log back in.

Why mid-bet logouts cluster around live betting

The distribution of the 34% is not uniform. It clusters hard in two windows, and both of them are structural rather than random.

The live-odds window

Live betting on football is the single largest source of mid-bet logouts in the Croatian sample, at 41% of the subset. The mechanism is simple. A player places a live bet at minute 63. They then do nothing for two to three minutes because there is nothing to do — the next meaningful odds movement is minutes away. The session reaper fires at 90 seconds. The player returns at minute 66 to check the cash-out value and finds a login screen.

The cash-out flow makes this worse. Cash-out offers are frequently the reason a player is sitting on the page at all, and a cash-out offer that expires while the session is dead is a cash-out offer the player never sees. In the sample, 18.7% of mid-bet logouts occurred within 30 seconds of a cash-out offer being generated server-side. The offer was live. The session was not.

The in-play tennis and basketball window

Tennis and basketball produce shorter, denser clusters. Between points, between free throws, between timeouts — the player is idle for longer than 90 seconds repeatedly, and each idle stretch is a coin flip on whether the session survives. Basketball in particular, with its media timeouts, produces a logout pattern that looks almost periodic in the logs.

The pattern is not the player's fault and it is not really the operator's fault either. It is a mismatch between a timeout designed for passive content consumption and a use case that is inherently stop-start.

The Croatian-specific pressure points

Croatia's market has three features that make a 90-second session TTL more damaging here than the raw percentage suggests.

Mobile share. Roughly 71% of Croatian online betting sessions in the sample originated on a mobile browser, against a European average closer to 63%. Mobile browsers are the exact environment where background-tab throttling is most aggressive. A desktop player who alt-tabs away keeps a live heartbeat for far longer than a mobile player who switches apps.

The app gap. Croatian-licensed operators have historically had a weaker native-app presence than their counterparts in markets like Italy or Romania, partly because app distribution for gambling products carries its own regulatory friction. That pushes more traffic into the browser, where the 90-second default lives.

Payment friction. Local deposit methods — card rails and the bank-transfer options that dominate in Croatia — frequently require a redirect out of the operator's domain. Every redirect is a backgrounded tab. Every backgrounded tab is a session on a 90-second clock. A player depositing €50 mid-session has a meaningful chance of returning to a login screen rather than a funded balance.

None of these are insurmountable. They are, however, the reason a stat that sounds like a generic UX complaint is actually a Croatian market problem with a Croatian market shape.

What operators have tried, and what actually moved the number

The obvious fix — raise the TTL — is the one most compliance teams reject first, because the 90-second window is often tied to an acquirer requirement rather than a product decision. So the interesting work has happened elsewhere.

Sliding expiry on authenticated activity

The single most effective change in the sample was making the session TTL slide on any authenticated request rather than on user-visible interaction. A heartbeat every 25 seconds from an open bet slip, even with no clicks, keeps the session alive without weakening the token lifetime. Operators that implemented this saw mid-bet logouts fall from 34.1% to 11.4% within one quarter. The token still expires in 90 seconds of true inactivity. The definition of inactivity just stopped including "watching a live market."

Server-side bet state that survives the client

A smaller but more robust fix is decoupling bet visibility from session state. If the open bet is rendered from a server-side push channel keyed to the account rather than the session, a re-login restores the exact view the player left. Two operators in the sample did this and reported a 63% drop in support contacts tagged "bet missing," which is a different metric from logout rate but arguably the one that matters.

The re-authentication flow itself

The least glamorous lever is the login screen. A player who is logged out mid-bet and then has to re-enter a password, wait for an SMS, and navigate back to the bet slip has been punished for something that was not their fault. Biometric re-auth — Face ID or fingerprint on the returning session — cut the median time-to-restored-bet from 47 seconds to 9 seconds in the operators that shipped it. That does not reduce the logout count. It reduces the damage per logout.

What did not work

Forcing a "stay logged in?" modal every 60 seconds reduced mid-bet logouts by a statistically meaningless amount and increased session abandonment on the pre-bet pages. Players do not want to be asked. They want the session to not die.

The compliance argument that keeps the 90-second default alive

It is worth being precise about why this is not simply a case of lazy engineering. A 90-second session token is a genuine control. It limits the window in which a stolen session cookie can be replayed, it satisfies acquirer requirements around transaction-page token lifetime, and it reduces the blast radius of a compromised device. Croatian operators are also subject to AML and responsible-gambling obligations that make "keep the session alive indefinitely" a hard sell to a compliance officer.

The resolution is not to abandon the control. It is to separate two things that were never the same thing: the lifetime of the authentication token, and the lifetime of the player's view of their own open position.

A token can expire at 90 seconds. A bet slip does not have to. The 34% figure exists because those two clocks were wired together by default, and nobody noticed until someone counted.

There is a responsible-gambling angle here too, and it cuts in an unexpected direction. A player who is repeatedly logged out mid-bet is a player who is being nudged toward re-entering the product more often, not less. Each forced re-authentication is a fresh exposure to the lobby, the promotions banner, and the deposit button. If the goal of a short session TTL is harm reduction, a mid-bet logout is arguably counterproductive — it interrupts the session at the moment of least risk and restarts it at the moment of most.

The number nobody has published

The 34% is a drop-logout figure, which means it counts sessions that ended without a clean logout request. That is a lower bound. Sessions that die and are immediately re-authenticated by a saved credential never appear in the drop-logout logs at all, but the player still experienced the interruption. If those are included, the true mid-bet interruption rate in the Croatian sample is plausibly north of 40%.

The open question is whether any operator will publish that number, and whether the acquirers who mandate the 90-second token will accept a fix that keeps the token short but the bet slip alive. The technical work is done and shipped by at least two operators. The remaining constraint is not engineering. It is whether a 90-second default that was chosen for server cost and compliance convenience gets re-examined now that someone has measured what it costs the player who is simply waiting for the next point.