Survive an expired session

How to do it

For script requests, the server answers 401 with problem details, never a redirect to an HTML sign-in page. The client keeps its state, opens sign-in in a dialog or a new tab, and retries the request once sign-in succeeds. Warn before a timed sign-out and offer more time, as time limits requires. The idle and total session limits are in lock down session cookies.

Examples

TypeScript example

export async function apiFetch(input: string, init?: RequestInit): Promise<Response> {
  const response = await fetch(input, init);
  if (response.status !== 401) return response;
  await signInAgain();
  return fetch(input, init);
}

Python example

@app.errorhandler(SessionExpired)
def session_expired(_error):
    wants_page = request.accept_mimetypes.best == "text/html" and "HX-Request" not in request.headers
    if wants_page:
        return redirect(url_for("sign_in", next=request.path))
    return problem(401, "session-expired", title="Please sign in again")

How to check

A browser test fills a form, deletes the session cookie and submits. A sign-in prompt appears, and after signing in the form is saved with the values typed before.

Sources

• WCAG 2.2 criterion 2.2.1 Timing Adjustable
• WCAG 2.2 criterion 2.2.5 Re-authenticating
• RFC 9457 Problem Details for HTTP APIs

Related rules

• AXS-36 Give people enough time in Accessibility
• APS-16 Lock down session cookies in Application security