I am in the process of creating an authentication system with angular.js
My goal is to implement a session timeout after a period of inactivity and expire the current session if a user logs in from another device.
In both scenarios - 1) idle timeout and 2) duplicate user login, the server will invalidate the token resulting in a 401 Unauthorized error for the user.
To handle this, I have set up a $httpProvider interceptor that catches the 401 error and displays a relevant message to the user.
The issue I am facing is determining whether the 401 error stemmed from 1) idle timeout or 2) duplicate user login. I tried storing a flag as a session attribute on the backend but cannot access it from the Angular frontend.
Therefore, my questions are:
1) Is it possible for JavaScript to read a session attribute? 2) If not, what other methods can be used to differentiate between an idle timeout and a duplicate user login when receiving a status code 410?
Thank you for your assistance!