Session timeout warning

Problem Context

• The product has authenticated sessions with idle timeout, absolute timeout, public-device risk, assurance-level requirements, or reauthentication policy.
• Users may be filling forms, reviewing payments, uploading files, editing content, approving records, or reading private data when inactivity occurs.
• A timeout can affect security and privacy as well as task continuity, especially on shared devices or sensitive data surfaces.
• The product can determine the authoritative session boundary from the server or identity provider rather than from a client-only timer.

Selection Rules

• Choose session timeout warning when the session is approaching an inactivity, absolute, device-lock, or reauthentication boundary that can interrupt authenticated work.
• Show the warning before the boundary, with enough time for users who need more time to respond, save, or reauthenticate.
• State the remaining time or expiry time, the consequence of expiry, and the status of current work.
• Use a modal or alertdialog when expiry is imminent and the next action must be chosen before continuing; use inline or banner status for earlier, less urgent warnings.
• Use exit warning when the user initiates departure; use session timeout warning when the system initiates a session boundary because of time or policy.
• Use autosave form to preserve progress continuously; still warn when pending or failed saves make timeout risky.
• Use permission denied state when the user is authenticated but lacks authorization, not when the session has expired.
• Do not offer Stay signed in when policy requires reauthentication or absolute termination; offer Save draft, Reauthenticate, or Sign out instead.
• After timeout, route users to sign in or reauthenticate and return to the original task with preserved data where policy and architecture allow.
• Treat public-device and high-risk flows carefully: hide private content after expiry, avoid leaking form values on signed-out pages, and disclose what remains recoverable.

Required States

• Active session with no warning.
• Early idle warning with remaining time and current save state.
• Imminent timeout dialog with Stay signed in or policy-valid action.
• Extension in progress state tied to server confirmation.
• Extension succeeded state that resets the displayed timer.
• Extension failed or expired state that routes to reauthentication.
• Absolute timeout or policy-required reauthentication state.
• Saved draft before timeout state.
• Timed-out signed-out state with private content hidden.
• Reauthenticated return state that restores the intended task and preserved work.

Interaction Contract

• The warning is driven by the authoritative session or identity state, not only a local countdown.
• Remaining time updates are readable and do not steal focus repeatedly.
• Stay signed in, extend session, or reauthenticate actions make a server-confirmed request and update the warning outcome.
• Save draft keeps recoverable work before expiry and tells users whether the save completed, failed, or remains local.
• If the session expires, private content is hidden and the next path is sign in or reauthenticate, not retrying the expired action blindly.
• After successful reauthentication, users return to the same route, step, record, or review state when policy allows.
• The warning never promises preservation or extension that the security policy cannot deliver.

Implementation Checklist

• Define idle timeout, absolute timeout, reauthentication threshold, extension limits, public-device behavior, and post-timeout retention policy with security owners.
• Use server or identity-provider expiry information to schedule warnings and verify extension success.
• Choose warning thresholds that leave time to read, save, extend, or reauthenticate, including users who need more time.
• Track work state separately from session state: clean, dirty, pending save, save failed, saved draft, submitted, and unrecoverable.
• Make Stay signed in, Save draft, Reauthenticate, and Sign out distinct actions with clear outcomes.
• Hide or clear sensitive UI after expiry while preserving allowed draft references or return targets.
• Announce imminent timeout and extension results without causing repeated screen reader interruptions.
• Test server-expired token, client clock skew, multiple tabs, backgrounded mobile app, failed extension, absolute timeout, saved draft return, reauthentication return, and shared-device sign-out.

Common Generated-UI Mistakes

• Using a client-only timer that disagrees with the server session.
• Showing Session expiring soon without a time, consequence, or action.
• Logging users out without preserving form work that could have been saved.
• Offering unlimited extension where policy requires reauthentication or termination.
• Treating timeout as access denied, not found, generic error, or retryable network failure.
• Leaving private content visible behind a timed-out overlay on shared devices.
• Interrupting users repeatedly with countdown announcements every second.

Critique Questions

• Which boundary is approaching: idle timeout, absolute timeout, reauthentication, or sign-out policy?
• Is the displayed countdown tied to the server or identity provider?
• What work is saved, pending, failed, local-only, submitted, or at risk?
• What action is actually allowed: extend, save, reauthenticate, finish, or sign out?
• What happens after expiry to private content and the user's return target?
• Can users who need more time perceive the warning and respond before the session ends?