Survive an expired session

How to do it

For script requests, the server answers 401 with problem details, never a redirect to an HTML sign-in page. The client keeps its state, opens sign-in in a dialog or a new tab, and retries the request once sign-in succeeds. Warn at least 2 minutes before a timed sign-out and offer more time, as time limits requires.

Example

export async function apiFetch(input: string, init?: RequestInit): Promise<Response> {
  const response = await fetch(input, init);
  if (response.status !== 401) return response;
  await signInAgain();
  return fetch(input, init);
}

@app.errorhandler(SessionExpired)
def session_expired(_error):
    wants_page = request.accept_mimetypes.best == "text/html" and "HX-Request" not in request.headers
    if wants_page:
        return redirect(url_for("sign_in", next=request.path))
    return problem(401, "session-expired", title="Please sign in again")

How to check

A browser test fills a form, deletes the session cookie and submits. A sign-in prompt appears, and after signing in the form is saved with the values typed before.