# Signing in again should not mean writing the report again

Separate the lifetime of authentication from the recovery of user work. Resume only after confirming the account, current permissions and any earlier submission outcome.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Identify what expires and what remains

A staff member spends half an hour writing a project assessment. Their session expires before they submit. Redirecting immediately to a sign-in page may discard the assessment even though ending access did not require destroying its draft.

Treat authentication state, draft state and business command state separately. A session determines whether the user may act now. A draft holds unfinished work under an appropriate data policy. A command records an attempted action whose outcome may already exist.

OWASP distinguishes idle and absolute session timeouts and recommends server-side enforcement. A client countdown can warn the user, but it is not the authority deciding whether a session remains valid.

## Preserve work under a deliberate policy

Choose where drafts live according to their sensitivity and the workflow. A server draft can be restored after reauthentication if the same account remains authorised. A local draft can survive a network interruption but needs careful handling on shared devices.

Do not preserve credentials with the draft. Keep authentication through the supported session mechanism and avoid copying tokens into local storage merely to make recovery easier.

Explain what is saved and what is not. If a file selection must be repeated, say so while preserving other answers. A recovery promise that silently excludes the user's main attachment will feel like data loss.

### Recovery checks identity before resuming work

Expired access pauses the workflow. The application restores appropriate state only after authentication and current authorisation succeed.

1. **Pause**: Retain permitted draft state and stop protected actions
2. **Authenticate**: Use the established sign-in flow
3. **Recheck**: Confirm account, permission and prior command outcome
4. **Resume**: Restore the draft or show the existing result

## Do not replay every failed request

An expired session response and a lost network response are different. The former may establish that the server rejected an unauthenticated action. The latter can occur after a successful write.

For consequential commands, retain a stable identity and recover the outcome before creating another action. A generic interceptor that signs in and blindly repeats every POST can duplicate a request or apply work in a changed context.

Even when a retry is safe, recheck the current record version and business rules. A draft prepared earlier may refer to a job that is now closed or assigned elsewhere.

## Confirm who returned

The person signing in may choose a different account or organisation. Do not automatically attach the previous draft to that new identity. Offer an appropriate explanation and a supported route back to the original context.

For shared-device use, hide or remove sensitive old-account data according to policy before exposing the new account's interface. Clearing the query cache and protecting draft access are distinct responsibilities.

## Make the interruption usable

Where the session policy permits an extension, provide a timely, operable warning and preserve the user's place. Apply the relevant timing-accessibility requirements and exceptions rather than assuming any security-related timeout is exempt.

After reauthentication, return to a validated internal destination with a clear state. The user should know whether their work is ready to review, already submitted or no longer authorised. Successful recovery restores understanding as well as data.

## Sources

- [OWASP: session management](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
- [OWASP: authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)
- [W3C WAI: timing adjustable](https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html)