Session timeout

Problem Context

• The user had an authenticated session that has already ended because of inactivity, absolute lifetime, logout, reauthentication policy, identity-provider termination, risk event, or session revocation.
• The current surface may contain private records, form answers, payments, admin actions, files, health data, financial data, or sensitive account state.
• The product may be able to preserve a server-side draft, return URL, record reference, transaction reference, or local non-sensitive recovery note without keeping the expired session active.
• The product must prevent stale submissions, stale downloads, stale previews, and privacy leaks while still making recovery understandable.

Selection Rules

• Choose session timeout when the authenticated session has already expired or been terminated and the next valid path is sign-in, reauthentication, restart, or safe task restoration.
• Use session timeout warning before expiry when users can still extend, save, sign out, or reauthenticate before the boundary is crossed.
• Use sign in when the user begins unauthenticated access normally; use session timeout when an existing authenticated task was interrupted and needs a return target or saved-state explanation.
• Use login for the credential-verification attempt and its outcomes; session timeout owns the expired-session screen before and after that attempt.
• Use permission denied state only when the user is authenticated but lacks authorization; do not send expired sessions into request-access flows.
• Use autosave recovery when the main issue is preserving failed or local-only work; session timeout may link to that recovery after reauthentication.
• Hide private content, field values, thumbnails, account balances, comments, files, and action controls until the user reauthenticates.
• Show safe context such as record type, masked account, draft timestamp, reference ID, or return destination when policy allows it.
• Disable or remove stale authenticated controls; do not let Submit, Export, Delete, Approve, Download, or Pay fire against an expired session.
• After successful reauthentication, restore the intended route, step, scroll position, focus target, and recoverable draft where policy permits.

Required States

• Expired session state with private content hidden.
• Inactivity timeout state with safe timestamp or duration explanation.
• Absolute timeout or policy timeout state that requires reauthentication.
• Signed-out recovery state with preserved return destination.
• Saved draft available after timeout state.
• No recoverable work state with honest restart path.
• Reauthentication in progress state that does not reveal private data.
• Reauthentication failed or canceled state that keeps the user signed out.
• Restored task state after successful sign-in.
• Multiple-tab or identity-provider timeout state where another session ended independently.

Interaction Contract

• The timeout state is driven by server or identity-provider session validity, not by a cosmetic client-only overlay.
• When session validity fails, authenticated actions are stopped before they submit, download, export, preview, delete, approve, or mutate data.
• Private content is hidden or cleared while preserving only safe recovery metadata such as reference, route, saved timestamp, or masked object name.
• Sign in or reauthenticate creates a fresh session and validates whether the return target is still allowed before restoring content.
• Canceled or failed reauthentication leaves the user in a signed-out state with safe navigation, restart, or support routes.
• Return restoration distinguishes server-saved work, local-only work, unrecoverable work, and policy-cleared work.
• The page does not call the expired state permission denied, network error, not found, or service unavailable.

Implementation Checklist

• Model expired authentication separately from unauthenticated first visit, authorization denial, network failure, and validation failure.
• Store a safe return target, task reference, draft reference, and last confirmed save timestamp outside the expired session where policy allows.
• Clear or hide sensitive DOM content, cached previews, media, inline files, and filled secret fields when session expiration is detected.
• Intercept stale authenticated controls and redirect them to the timeout state instead of letting them retry with expired credentials.
• Validate return targets after reauthentication to avoid open redirects, stale permissions, deleted objects, or cross-account restoration.
• Support multiple tabs and federated identity sessions where one surface expires independently from another.
• Log timeout shown, reauth started, reauth success, return restored, restart chosen, and abandoned recovery without logging private field values.
• Test idle expiry, absolute expiry, identity-provider timeout, revoked session, back-button return, reload, mobile backgrounding, multiple tabs, failed reauth, canceled reauth, and shared-device privacy.

Common Generated-UI Mistakes

• Leaving the private page readable behind a timeout modal.
• Calling an expired session Access denied and offering request access.
• Letting stale Submit, Export, Approve, Delete, Download, or Pay buttons remain active after timeout.
• Dropping users on an unrelated dashboard after reauthentication even when a safe return target exists.
• Promising that work is saved when only an expired client page still holds it.
• Putting session tokens, raw URLs with secrets, form answers, or private object titles into timeout logs or support references.

Critique Questions

• Has the authenticated session already ended, or is this still a pre-expiry warning?
• What private content must disappear immediately from the timed-out page?
• Which safe reference, save timestamp, route, or draft identifier can be shown while signed out?
• Which controls must be disabled or removed because they require an active session?
• After reauthentication, where should the user return and what data can be restored?
• How does the state behave across refresh, back button, mobile backgrounding, and another tab ending the session?