Ask HN: Best Practices for Sessions?

I have a client that needs short sessions for security reasons. We tested 5 minutes and found it was too short. We are wondering if there is a best practice or a standard for session times.

Also, I have other questions about security/privacy. But I just want to see what you know about sessions for now.