---
title: "Verify session expiry preserves an honest unsaved-form state"
description: "Test an expired session during form editing and confirm the app requires sign-in, avoids a phantom save, and handles the draft according to policy."
canonical_url: "https://vostride.com/agent-library/authentication/expired-session-unsaved-form.md"
md_url: "https://vostride.com/agent-library/authentication/expired-session-unsaved-form.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify session expiry preserves an honest unsaved-form state

Test an expired session during form editing and confirm the app requires sign-in, avoids a phantom save, and handles the draft according to policy.

## Risk

A form opened under a valid session can outlive that session. If the interface claims success after the save request is rejected, users may lose work or incorrectly believe a sensitive update was recorded.

## Fixtures

- A test-owned editor account and an existing draft with a known saved title.
- An application-supported fixture hook that expires only this account session after the form opens.
- A written decision about draft restoration after reauthentication and a read-only record inspection hook.

## Steps

1. Open the editor and verify the saved title; replace it with a unique unsaved title without submitting.
2. Run the session-expiry fixture hook, then press Save once and verify the app requests authentication instead of displaying a saved confirmation.
3. Use the record inspection hook and verify the persisted title is still the original value.
4. Reauthenticate through the supported flow and verify the editor either restores the unsaved title or clearly explains its documented loss.
5. If restoration is supported, save explicitly and verify both the visible title after reload and the persisted record now match the new title.

## Expected results

- An expired-session save does not mutate the protected record.
- The interface communicates authentication failure without an inaccurate saved status.
- Draft restoration or loss matches the documented product behavior and requires an explicit successful save.

## False-pass traps

- Checking only the form input after submission can mistake local state for persistence.
- Automatically signing in before the expiry step would remove the failure condition this scenario is meant to exercise.

## Cleanup

- Restore the original draft through a fixture hook and invalidate sessions created by the scenario.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)