Manage authentication flow

We have to get login working for the mobile web client by Wednesday. Implement the authentication flow that accepts email and password, sends them to the server for a session token, stores the token in a secure, non-accessible cookie, refreshes the token before expiry, and redirects to the dashboard on success. Failures should show a clear error message without exposing server internals.

Before I hand auth to the security reviewer, make the flow easy to verify: add a visible token expiry countdown in dev mode, document which endpoints exchange credentials and which set cookies, surface where tokens are stored and why (cookie vs localStorage), and flag any places that still read the raw token directly in client code.

Some users report they get logged out when they reload the app. The server issues short-lived session tokens and we store them in a secure cookie, but we also recently added an iframe that hits an auth-heavy endpoint. I suspect SameSite or cookie path issues or that the refresh-before-expiry logic doesn’t run for cold loads. I can’t reproduce reliably. What are the most likely causes and the quickest checks to confirm whether cookies, SameSite, or missing refresh calls are to blame?

Across several releases we keep introducing session reliability problems: token expiry handling, inconsistent storage between SPA and legacy pages, and refresh race conditions. These cause support tickets and urgent patches. Which two practices or small technical boundaries should we adopt to reduce these issues — one change to the auth codebase and one process change for future work?