As long the server supports it, nearly infinite, but most protocols require an redirect, since they can't access the cookies of the loginsite.