shadcn.io is not affiliated with official shadcn/ui
Session Timeout Dialog Block for React
A bank's accounts page with an alert dialog shown open that warns before an idle session ends: a one-minute clock with a draining bar, Stay signed in and Sign out now, and a signed-out view at zero.
Installation
Overview
Warn before a quiet session ends, and let people keep it, with this timeout dialog for React with Base UI. It opens from the accounts page of Copperfen, an online bank: the page, a balance and two transactions, is drawn under a soft scrim inside a hairline frame with a plus mark on each corner, and its header holds an outline Simulate idle Button. The Alert Dialog centres a title, a sentence, large digits from the Timer counting down from a minute, and a thin bar along its top edge that drains over the same minute. Stay signed in, the only Shine Button, has first focus and starts the clock again; Sign out now is outline. At zero the same dialog says you were signed out and offers Sign in again, and the page veils its account. For preview the dialog is drawn open in place when the page loads, its clock stopped at 1:00; the Simulate idle button opens the real Alert Dialog, where the clock runs. For banking, health, admin tools and any app that ends idle sessions.
FAQ
Why is the dialog already open, and why is its clock stopped?
So you can see it without a click, and so a poster never ages. On load the alert dialog is a copy drawn in place over the page: a native dialog element with the alert dialog role that isn't modal, so nothing is trapped or focused, its digits stopped at 1:00 and its bar full. The Simulate idle button opens the real Alert Dialog, modal, with its focus trap, Escape and focus return, and there the clock runs from the moment it opens and starts over each time. The copy stays closed until a reload. Both show the same TimeoutFields component and share the block's state. In your app keep the Alert Dialog and drop the copy: the "in-place" state, the scrim and the dialog element inside the frame.
Does a screen reader hear the clock?
Not every second. The digits are hidden from assistive technology, and a polite status line speaks only at 30 seconds, at 10 seconds and when the session ends. That line lives inside the dialog, because a modal hides the rest of the page from a screen reader. The sentence in the dialog carries the rule in words, and the person can always extend it with a button, which is the first control focused, so the time limit can be turned off or extended as WCAG 2.2.1 asks.
What stays local, and how do I wire it for real?
Nothing signs out. At zero, or on Sign out now, the page's account is veiled with a note and the header's button becomes Sign in again, which lifts the veil. In your app call your sign-out and refresh endpoints from leave and keep, reset the clock on real activity (key presses and pointer moves, throttled), and share the session's state between tabs, for instance with a BroadcastChannel, so one tab's warning doesn't contradict another's. A real app also resets on activity: here only a button extends the session.
What does Escape do?
It closes the warning and the session goes on, and the polite status says so. It never signs anyone out. An alert dialog is also the kind that a click outside doesn't close, because the question needs an answer, and first focus lands on Stay signed in rather than on a way to leave.
What if I prefer reduced motion?
The bar along the top is left out and the digits still run: the time still passes, so the number has to keep moving, but nothing slides.
Is it accessible from the keyboard?
Yes. The real alert dialog is named by its title and described by its sentence, first focus lands on Stay signed in, and Escape returns focus to the header's button. After a result, focus goes to the header's button again, whichever one it is now. The trigger is passed to AlertDialogTrigger through render, the dialog is controlled with open and onOpenChange, and first focus is set with initialFocus. The copy shown on load moves no focus.
Related
- Pro
Session Policy Settings
Sign-in and securityA session policy settings panel that leads with the sentence the settings amount to, two sliders with stops for the idle timeout and the longest session that hold each other to one rule, a device limit and an end-all-sessions dialog.
- Pro
Signed Out Devices Success
Security and accessA confirmation panel for signing out every other session: a row of marks for how many sessions remain, the four devices with a state each and a ghost Sign out here too that signs this device out on the page.
- Pro
Rate Limit Dialog
Status and errorsAn API console with its 429 notice shown open: a dialog with the quota used, the plan's limit, a clock to the reset and a Countdown Button that turns into Retry request when the wait ends.
- Pro
Sign-In Gate Dialog
Account and securityA paid newsletter page with its sign-in dialog shown open: email and password with a show and hide button, a remember box, a reset link, two provider rows, and a page that lifts its blur once you are in.
- Pro
Password Re-Entry Confirm Dialog
Destructive confirmsA hosting dashboard with an alert dialog shown open that asks for the password again before a project is deleted: a lock tile, one field, a Caps Lock note, a count of tries and a destructive confirm.
- Pro
API Error Dialog
Status and errorsA deploy platform's overview with its failed card and the error alert shown open: the 502 status, the code and request id, a retry ladder of three attempts, a real copy of the error report and the error body as a JSON tree.