title: How to gracefully handle login expiration for an Ajax call?
body: <p>My web application is made up of a lot of Ajax calls to server side <code>RESTful APIs</code>. Each time a customer login my site, the login page will get a <code>JWT</code> (JSON Web Token) token from server and store it as a <code>cookie</code> on client side. (<em>I choose to store it as cookie because it is the only way to let the browser send it automatically and it is said to be safer than HTML5 Web Storage</em>). There's a field in the token describing the token's expiration date. For each Ajax call, the token is sent along for authentication.</p>
  
  <p>If client stays on my page for long, the token can expire. And the server will detect it when client making the next HTTP request (not just REST call). I use a <code>servlet filter</code> to intercept <code>all</code> HTTP requests and check the token for expiration. If the token expired, a <strong>redirection-to-login-page</strong> response will be sent.</p>
  
  <p>But there's a problem about the above approach: "How to gracefully handle the <strong>redirection-to-login-page</strong> response on client side?"</p>
  
  <ul>
  <li><p>For <code>non-Ajax</code> originated HTTP request, I can rely on browser to handle the redirection-to-login-page response and make page jump automatically.</p></li>
  <li><p>For <code>Ajax</code> originated HTTP request, it seems I need to add extra logic to <code>each</code> ajax call's <code>completion handler</code> to detect the redirection-to-login-page response and <code>imperatively</code> make the page jump . </p></li>
  </ul>
  
  <p>Or am I totally on a wrong way?</p>
  
  <p><strong>Some refs:</strong></p>
  
  <p><a href="https://stackoverflow.com/questions/26739167/jwt-json-web-token-automatic-prolongation-of-expiration">JWT (JSON Web Token) automatic prolongation of expiration</a></p>
  
  <p><a href="https://stackoverflow.com/questions/34098031/wich-authentication-strategy-should-i-use-for-my-api">Which authentication strategy should I use for my API?</a></p>
  
  <p><a href="http://leastprivilege.com/2015/04/01/implicit-vs-explicit-authentication-in-browser-based-applications/" rel="nofollow noreferrer">Implicit &amp; Explicit authentication</a></p>
  
  <p><strong>ADD 1:</strong></p>
  
  <p>It seems the browser will handle the 302 redirection transparently. <strong>So maybe I can just return a 302 redirection to the login page, be it for a ajax call or a plain page visit.</strong> I will try and respond later.</p>
  
  <p>From <a href="http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060405/#xmlhttprequest" rel="nofollow noreferrer">here</a>: </p>
  
  <blockquote>
    <p>If the response is an HTTP redirect (status code 301, 302, 303 or
    307), then it MUST be transparently followed (unless it violates
    security or infinite loop precautions). Any other error (including a
    401) MUST cause the object to use that error page as the response.</p>
  </blockquote>
  
  <p><a href="https://stackoverflow.com/questions/373087/catching-302-found-in-javascript">Catching 302 FOUND in JavaScript</a></p>
  
  <p><a href="https://stackoverflow.com/questions/199099/how-to-manage-a-redirect-request-after-a-jquery-ajax-call">How to manage a redirect request after a jQuery Ajax call</a></p>