Fix repeated sign-in prompts and session timeouts all day

TL;DR — If you are being asked to sign in over and over, the most common cause is that your browser is blocking or clearing the cookie (a small file that keeps you signed in) the app needs. Start by testing in a private window with extensions off, then check whether your browser is clearing cookies on close or blocking third-party cookies; if that is not it, check device time and your identity provider session settings. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon. You sign in to your company portal, open a couple of tabs, answer one message, and then suddenly get sent back to the login screen again. You sign in, it works for ten minutes, and then it happens again in another tab or after clicking a link from email. By the third or fourth time, you are wondering whether the site is broken, your browser is broken, or someone changed a security setting without telling you.

Symptoms

• You successfully enter your username, password, and possibly MFA (multi-factor authentication), then return to the app and are asked to sign in again minutes later.
• Opening a new tab to the same app shows a login page instead of your dashboard.
• Typical messages include:
  • Your session has expired. Please sign in again.
  • We couldn't keep you signed in.
  • Invalid state or state mismatch
  • Cookies are required to sign in
  • Too many redirects
• The app may bounce between your app URL and your identity provider login page several times.
• In the browser developer tools, you may see failed requests with status codes like:
  • 401 Unauthorized
  • 403 Forbidden
  • 302 Found repeated in a loop
• If your organization uses single sign-on, other company apps may also ask you to sign in more often than usual.

Likely causes

Step-by-step diagnosis

1. Test in a private/incognito window first

   • Action: Open a private/incognito window, then sign in to the app there.
   • What it means: If the problem goes away in private mode, your normal browser profile is the problem—usually an extension or cookie/privacy setting.
   • Jump to: Fixes → Browser is blocking, deleting, or isolating cookies or Fixes → Privacy/ad-block extension is breaking the login flow.

2. Check whether your browser is clearing cookies or blocking them

   • Action: In your browser settings, go to Privacy/Security and search for cookies.
   • Common paths:
     • Chrome/Edge: Settings → Privacy and security → Third-party cookies
     • Firefox: Settings → Privacy & Security → Cookies and Site Data
     • Safari on macOS: Safari → Settings → Privacy
   • What it means: If you see settings like Block third-party cookies, Clear cookies when browser closes, or your app/identity provider is listed under blocked sites, this is likely your problem.
   • Jump to: Fixes → Browser is blocking, deleting, or isolating cookies.

3. Turn off extensions for one test

   • Action: Disable ad blockers, privacy tools, and script blockers, then sign in again.
   • Common browser paths:
     • Chrome/Edge: Menu → Extensions → Manage Extensions
     • Firefox: Menu → Add-ons and themes → Extensions
   • What it means: If sign-in becomes stable after disabling an extension, that extension is interrupting the login redirect or cookie write.
   • Jump to: Fixes → Privacy/ad-block extension is breaking the login flow.

4. Check your device clock

   • Action: Open your device Date & Time settings and confirm the time, date, and time zone are correct.
   • Common paths:
     • Windows: Settings → Time & language → Date & time
     • macOS: System Settings → General → Date & Time
     • iPhone/iPad: Settings → General → Date & Time
     • Android: Settings → System → Date & time
   • What it means: If the clock is off by more than a minute or two, login tokens (signed time-limited passes) can look expired immediately.
   • Jump to: Fixes → Device date/time is wrong.

5. See whether this affects other company apps too

   • Action: Sign in to another app that uses the same company login.
   • What it means: If multiple apps ask you to sign in repeatedly, the issue is probably with your identity provider session policy rather than one app.
   • Jump to: Fixes → Identity provider session is expiring too quickly.

6. Inspect the session cookie in the browser

   • Action: Open browser developer tools, then inspect cookies.
   • Common paths:
     • Chrome/Edge: F12 → Application → Storage → Cookies
     • Firefox: F12 → Storage → Cookies
   • What it means: If the app session cookie is missing, disappears after redirect, has the wrong domain, or is missing Secure/has an incompatible SameSite value, this is your problem.
   • Jump to: Fixes → App cookie settings are misconfigured.

7. If you manage the app, check whether sessions are shared across servers

   • Action: In your hosting provider's dashboard, look at recent requests and which app instance handled them; if you have CLI access, check whether session storage is local memory on each server.
   • What it means: If requests alternate between servers and each server has its own separate in-memory sessions, you can appear logged in on one request and logged out on the next.
   • Jump to: Fixes → Load balancer or app servers are not sharing session state.

Fixes

Browser is blocking, deleting, or isolating cookies

The login flow usually needs cookies from your app and sometimes from your company login provider.

• In Chrome/Edge:
  • Go to Settings → Privacy and security → Third-party cookies
  • If Block third-party cookies is on, either turn it off for testing or add exceptions for your app and login domains under allowed sites.
• In Firefox:
  • Go to Settings → Privacy & Security
  • Under Enhanced Tracking Protection, switch from Strict to Standard for testing, or add a site exception.
• In Safari:
  • Go to Safari → Settings → Privacy
  • For testing, review settings that prevent cross-site tracking.
• Also disable any setting that clears site data on browser close.

If you know the domains, add both the app and login provider as allowed sites, for example:

https://app.example.com
https://login.example.com

Verify it worked: Sign in, close only the app tab, reopen the app in a new tab, and confirm you stay signed in.

Privacy/ad-block extension is breaking the login flow

Extensions can block redirects, scripts, or cookies used during sign-in.

• Disable privacy, ad-block, anti-tracking, or script-blocking extensions for the app and login pages.
• In Chrome/Edge: Menu → Extensions → Manage Extensions → toggle Off
• In Firefox: Menu → Add-ons and themes → Extensions → Disable
• If you do not want to disable the extension globally, use its Allow on this site or Pause on this site option for:

app.example.com
login.example.com

Verify it worked: Re-enable extensions one by one, signing in after each, until the issue returns; the last one enabled is the cause.

Device date/time is wrong

Login tokens are time-sensitive. A wrong clock can make a fresh token look expired.

• Windows: Settings → Time & language → Date & time → Set time automatically → On
• macOS: System Settings → General → Date & Time → Set time and date automatically → On
• Mobile: enable automatic date/time and automatic time zone.
• After changing it, fully close the browser and open it again.

If you are on a managed work device and cannot change time settings, contact your IT team and tell them the device clock is out of sync.

Verify it worked: Sign in again and confirm the session lasts longer than before.

Identity provider session is expiring too quickly

If many company apps are affected, your organization's login service may have a short session policy.

For the customer/user:

• Report it to your admin or support team with exact timing, for example:

I am being asked to sign in again after about 10 minutes of inactivity and sometimes even while active. It affects App A and App B.

For the admin/support team:

• In your identity provider dashboard, review session lifetime, sign-in frequency, and conditional access/session control policies.
• Look for settings named like:

Session lifetime
Sign-in frequency
Persistent browser session
Idle timeout
Remember browser

• Increase overly aggressive values to match your security policy and user needs.

Verify it worked: A user can stay signed in across more than one app for the expected session duration.

App cookie settings are misconfigured

If you manage the application, check the session cookie attributes. Common problems are the wrong domain, missing Secure, or a SameSite value that breaks single sign-on redirects.

Typical correct pattern for a secure app over HTTPS:

Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax

If your login flow needs a cross-site redirect from a separate login domain, you may need:

Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=None

Examples:

• Express / Node.js

app.set('trust proxy', 1);
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'lax'
  }
}));

• nginx reverse proxy forwarding HTTPS info

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;

If the cookie domain is too narrow or wrong, set it to the exact app host or the correct parent domain only when needed.

Verify it worked: In DevTools, the session cookie remains present after login and after navigating between pages.

Load balancer or app servers are not sharing session state

This is common when one server stores sessions only in local memory.

• In your hosting provider dashboard, check whether the app runs on multiple instances.
• If yes, move sessions to shared storage such as Redis (an in-memory data store shared by all app servers) or use signed stateless sessions if your app supports them.

Example Express with Redis:

const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient({ url: process.env.REDIS_URL });
redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' }
}));

As a temporary workaround, your hosting or load balancer may offer sticky sessions (send one user to the same server each time), but shared session storage is the better fix.

Verify it worked: Refresh the app repeatedly and confirm you stay signed in even when requests are served by different instances.

Prevention

• Add a browser-based login test in CI/CD that signs in and verifies the session survives navigation for at least 15 minutes.

npm run test:e2e -- --grep "login session persists"

• Log and alert on redirect loops and auth failures. Track spikes in 401, 403, and repeated 302 responses for login routes.

{"alert":"auth-loop","threshold":"302 responses > 20 per user in 5 min"}

• Pin cookie settings in app config and review them during releases.

{"sessionCookie":{"secure":true,"httpOnly":true,"sameSite":"lax"}}

• If you run more than one app server, store sessions in shared storage from day one instead of local memory.

Session store: Redis
Not recommended: in-memory session store on each instance

• Add a deployment check that confirms the reverse proxy forwards HTTPS headers correctly.

proxy_set_header X-Forwarded-Proto $scheme;

• Monitor time sync on managed devices and servers. If you manage servers, alert when NTP (network time protocol) drift exceeds a small threshold.

Alert when clock drift > 60 seconds

This article was written by an AI system and published pending human review. Verify anything you intend to act on.