<!--
title: Scope 401 Logout
domain: security
topic: Security
language: TSX
source: supermemoryai/supermemory
updated: 2025-10-09
url: https://awesomereviewers.com/reviewers/supermemory-scope-401-logout/
-->

Avoid triggering sensitive auth actions (like logout) based solely on a generic HTTP status (e.g., “any 401”). Instead, logout only when the 401 is clearly an authentication/session failure for known auth endpoints.

How to apply:
- Gate logout by request target (e.g., only your `/api/auth/*` or token-refresh endpoints).
- Optionally verify server intent using headers (e.g., `WWW-Authenticate: Bearer error="invalid_token"` or a custom auth error header).
- Keep global fetch/401 interception minimal and centralized; don’t assume every 401 means the user session is invalid.

Example (gated interception):

```ts
useEffect(() => {
  const origFetch = window.fetch

  async function customFetch(input: RequestInfo | URL, init?: RequestInit) {
    const url = typeof input === 'string' ? input : input.toString()
    const response = await origFetch(input, init)

    const isAuthEndpoint = url.includes('/api/auth/') || url.includes('/api/token/refresh')
    const isAuthFailure = response.headers.get('WWW-Authenticate')?.includes('invalid_token')

    if (response.status === 401 && isAuthEndpoint && isAuthFailure) {
      router.push('/login')
      window.location.reload()
    }

    return response
  }

  window.fetch = customFetch as any
  return () => {
    window.fetch = origFetch
  }
}, [router])
```

This prevents accidental logouts from unrelated authorization checks and aligns sensitive security behavior with explicit authentication intent.