Session signed out pop up in Author is not showing up in AEM Sites

[Saravanan_Dharmaraj]

We are trying to set session timeout for the users in AEM Sites author by configuring the "Apache Jackrabbit Oak TokenConfiguration" to 15 mins(900000) for Token Expiration. 

After 15 mins, the token is getting expiration and forcing the user to re-authenticate by taking the user to the IDP which is good and working as expected. But we are not seeing the Session signed out pop up in AEM Sites before taking the user to IDP for authentication. 

We did the same token configuration in AEM Assets , there we see the session signed out pop comes up to indicate the user to re-authenticate. My question is what config determines this pop up to show up or not? Anyone knows why it behaves different between AEM Sites vs AEM Assets.

[narendiran_ravi]

Hi @Saravanan_Dharmaraj ,

I tested this behavior locally by manually removing the tokens from the console (/system/console/tokenmgr). The alert was triggered in both the Assets Console and the Sites Console.

During debugging, I found that the popup is triggered based on the following sequence:

• In /libs/granite/ui/components/shell/clientlibs/shell.js, the updateBadge function makes a ajax request to /mnt/overlay/granite/ui/content/shell/header/actions/pulse.data.json every two seconds.

function updateBadge(el, src, resolveWhenNewData) {
        var user = el[0].dataset.graniteShellBadgeUser;
        var label = el[0].dataset.graniteShellBadgeLabelTemplate;
        getData(user, src, resolveWhenNewData).then(function(data) {
            el.attr("badge", data.total);
            if (label) {
                el.attr("aria-label", label.replace("{{count}}", data.total));
            }
        });
    }

• If the response status is 403 Forbidden, and the header X-Reason is "Authentication Failed", the handleLoginRedirect function is triggered.

• The handleLoginRedirect method is defined in /etc.clientlibs/clientlibs/granite/utils.js and is called from /etc.clientlibs/clientlibs/granite/jquery/granite.js.

updateBadge function continuously checks for updates, and when the session token is missing or invalid, it triggers an authentication failure, resulting in a forced login redirect.

This should help in your analysis why this behavior is occurring on your sites. Let me know if you need further insights!