dnoulet/go-guess
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: redirect expired sessions to login

Browse source 
Invalidate authentication on protected 401 responses and JWT expiration, redirect to the login route, and explain that the session is no longer active.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Daniel Noulet 2026-09-20 07:16:38 +02:00
parent c050815900
commit 0d8a25e73f
6 changed files with 147 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
frontend/README.md
View file

@ -37,7 +37,10 @@ application shell.
Vite proxies `/api` to `http://localhost:8080`. Login stores the returned JWT in
`sessionStorage`; protected requests send it as `Authorization: Bearer <token>`. API failures are
shown in the UI and are never replaced with demo data.
shown in the UI and are never replaced with demo data. A `401` from a protected
JSON, file, or event-stream request clears authentication and returns the user to
`/login`. The app also schedules logout from the JWT expiration claim so an idle
expired session cannot remain on a protected page.
Supported routes: