It's by default 60 minutes. User will be logged out after the timeout if page is not auto-refreshed. Otherwise, each refresh will reset the timeout. For most of the pages there should be no auto-refresh, though. You can adjust the timeout by updating config.properties or providing a custom.settings file.
We are working now on exposing that configuration to REST API and Web UI. That should be available early 2020.