Secured Application Step 5: The Client Half

Model your frontend auth state as a union with the unknown case included, and fix every place that treated unknown as signed out. Add one interception point that handles 401 and 403 differently and carries the destination through sign-in. Then test the flows by hand: load a protected page directly while signed out, expire a session while typing, sign out in one tab with another open, and reload while signed in and watch for a flash. Fix what you find.