Design for Forms Left Open Too Long

Security & Access · forms, security, undo

Updated 2026-08-04

Assume a form will sit open for hours. People start something, switch tasks, and come back, by which time the session may have expired and the CSRF token that protects the submission may no longer be valid.
Never let expiry destroy the work. The submission can be refused, and the content must survive so the user signs in again and continues rather than starting over.
Warn before the deadline rather than after it. A quiet notice a few minutes out lets someone finish, and a rejection after twenty minutes of typing does not.
Refresh the protection quietly while the user is active. Typing, scrolling, and clicking are all evidence that the person is still there.
Say what actually happened in the failure message. Your session expired while you were away. Sign in and we will submit this. is a recoverable situation, and a generic Invalid request looks like data loss.
Return the user to the exact place they were, with the fields still filled, after they re-authenticate. A redirect to the dashboard turns recovery into abandonment.
Save drafts locally for long forms so a closed tab is not a total loss, and clear them once the submission succeeds so old content cannot reappear later.
Treat the second tab as normal. Someone signed in twice, or signed out in one window and submitting from another, is a case the form has to handle without blaming them.

The protections around a form are invisible until they expire, and the moment they expire is the moment the user finds out how much you valued their work.