Bamboo currently will currently set it's default timeout to be that of the Tomcat server, which by default is 30 min. The session will be invalidated when there is no activity for the specified period. However, when a user is on a page that continually polls the server for updates (such as a dashboard with builds) the session is always considered active - and will effectively prevent time out.

An improvement for Bamboo would be to be able to specify a time period that can be set in the UI that will force the invalidation of the login, regardless of the session activity.