Hi, re session expiry and refresh We have implemented a side channel to refresh sessions which are still "active", however our UI does not poll so we cannot know when the session has expired. One possibility would be to add another cookie returned by our backed (GraphQL: in our case) which is not HTTP_ONLY but which only contains the session expiry timestamp. This way the Ui can "know" when it gains focus after an idle period weather it should redirect to the login UI or if the session is still active Have I missed a simpler approach or is this sensible?

That seems sensible.