Flows and Expiry

Return them to where they were going. Somebody follows a link to a protected page, signs in, and should land on that page, not the home page. Carry the destination through the flow and use it. It is a small thing that is noticeably absent when missing.

Handle expiry at one place. A single point that intercepts responses, notices a 401, and reacts: refresh if you can, otherwise clear the credential and send them to sign in with their destination attached.

Scattering that handling through components means one of them will forget, and the symptom is a page that silently shows nothing.

Distinguish 401 from 403. A 401 means sign in. A 403 means you are signed in and still not allowed, and sending that to the sign-in page produces a loop where signing in appears to do nothing.

◈ Graded Challenge

Write on_response(status, auth_state) deciding what the client should do. auth_state is "unknown", "signed_out" or "signed_in". Return one of: "render" when the status is below 400; "sign_in" when the status is 401; "forbidden" when the status is 403; "retry" when the status is 500 or above; and "error" for any other 4xx. One exception: when the status is 401 and auth_state is already "signed_out", return "render", because sending an already signed-out visitor to sign in again is a loop.

Name it exactly: on_response(status, auth_state)

Python3 visible + 5 hidden

loading editor…

Mark this lesson complete

Signed in, your progress follows you to every device.

Next: Practice Test →

← Back