Currently, we do not provide any user-facing indication that authentication has failed, and even worse, the application state may be inconsistent, with other parts of the code assuming that the presence of the authState object implies that the user is authenticated.
A better user experience would be to fully reset the application authentication state, and if the user were on a page that required authentication, redirect them to the login page.
When constructing the app context, we have an explicit check as to whether the authentication access token has expired, and if so, we attempt to refresh it using the Auth0 library in https://github.com/ShelterTechSF/askdarcel-web/blob/c8f11101dc0297fe073a42eab294116cd61368e7/app/utils/useAppContext.tsx#L114. However, refreshing the access token can fail if the user's session, as stored in a cookie, has itself expired, which would require the user to authenticate with Auth0 again.
Currently, we do not provide any user-facing indication that authentication has failed, and even worse, the application state may be inconsistent, with other parts of the code assuming that the presence of the
authStateobject implies that the user is authenticated.A better user experience would be to fully reset the application authentication state, and if the user were on a page that required authentication, redirect them to the login page.