We have built an extension in our SC webstore where the user can perform various operations on a specific page, but the URL does not change when they are working on the page. We do communicate constantly with the backend with every operation they perform (using Services in our extensions). But, after 15 minutes, they are automatically logged out (the session expires; I understand this is according to PCI guidelines). Even though there is activity, I guess the session expires because the URL does not change for the whole time? We would like to keep the session alive in this scenario. Is there any way to achieve this?

The idle timeout is because there is no backend activity being made that requires a secure part of the site.

Got it. I was wondering why the session expires even after all that backend activity, but now I understand the reason. Thanks for the quick response Steve, that helps a lot. 🙂