Return 401 on expired/missing session?

[Peter Schober]

* Jim Fox <fox at washington.edu> [2018-04-09 20:12]:
> My experience is that the 302 redirect is followed, but considered a
> cross-site redirect error by the idp.  This causes a final response
> code of zero, not 200 or 302.  I detect the zero response code to
> mean the user has to reauthenticate.

AFAIK in our case the JS in the browser silently (when one is not
checking the browser's JS console) fails with a CORS error due to the
redirect to the IDP (or rather from the next redirect within the IDP).

I guess one workaround would be not actively protecting the
application with shib, then lack of attributes sent in API responses
signals a need to refresh the session, but without confusing the JS
code with redirects meant for the browser...

-peter