Session timeout warning
A warning before the server signs somebody out for inactivity, with a way to stay signed in: WCAG 2.2.1 (Timing Adjustable) asks for both. Worth having before any app that holds health data adds an idle timeout. The rules: warn well ahead (two minutes in a real app), treat closing the warning as staying, never as signing out, say what will be lost, and announce the countdown sparingly rather than every second.
Try it
This demo uses a 40-second session: the warning appears 10 seconds after you start it, then counts down 30 seconds. Press Stay signed in, or Escape, to start again; let it run out to see what happens next. Open this page in a second tab and start it there too: staying signed in from one tab moves the other tab's clock as well.
Using it in an app
- Include
components/_session_timeout.html.twigonce in the signed-in shell, with the server's real idle timeout and a 120-second warning. - Add a keep-alive route:
POST, CSRF-checked, touching the session and answering 204. - Point
expired_urlat the sign-in page, with a note saying why they were signed out. - Copy
session_timeout_controller.js; there are no inline handlers.