Skip to content

[FE-82] Graceful session expiry handling #1024

Description

@mftee

Overview

When a token expires mid-session — plausibly while a user is partway through uploading and annotating a document — the failure must be handled deliberately rather than dropping them somewhere confusing with their work lost.

Tasks

  • Detect 401 centrally and attempt a single refresh, queueing concurrent requests until it resolves.
  • Prevent refresh stampedes: many simultaneous 401s must trigger exactly one refresh call.
  • On refresh failure, clear session state and redirect to login preserving both the intended destination and the active locale.
  • Warn before expiry with a "Stay signed in" prompt rather than dropping the session silently.
  • Preserve in-progress form and upload state across the redirect where practical.
  • Synchronize logout across tabs via a storage event.
  • Add a test proving ten concurrent 401s produce one refresh.

Acceptance Criteria

  • An expired token refreshes transparently with no visible failure.
  • Failed refresh returns the user to their original page and locale after re-authenticating.
  • Concurrent 401s produce exactly one refresh request.

Dependencies

Interacts with the API client work already filed.

Notes for Contributors

Comment below to be assigned.

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions