Login Time-out
ActiveHTTP 440 Login Time-out is a Microsoft IIS-specific status code indicating the client's session has expired due to inactivity. IIS uses 440 when the user's authentication session times out and they need to log in again. It is equivalent to a session expiration – the client should re-authenticate. Not defined in any RFC.
Description
IIS returns 440 when a user's authenticated session exceeds the configured session timeout. This is an authentication session timeout, not a request timeout. The client should redirect the user to the login page. In web applications running on IIS, this is the mechanism for 'your session has expired, please log in again.' Not to be confused with 408 Request Timeout (the RFC-standard code for a client that takes too long to complete a request).
Examples
HTTP/1.1 440 Login Time-out
# IIS-specific – redirect user to login page
Location: /login?returnUrl=/protected-pageEdge Cases
- •440 is IIS/Microsoft-specific. Apache, Nginx, and other servers do not use it.
- •The RFC-standard approach is 401 Unauthorized or 403 Forbidden after session expiry.
- •ASP.NET Identity and Azure AD use 401 with WWW-Authenticate for session expiration.
When You'll See This
- →ASP.NET Forms Authentication session expires after inactivity period
- →IIS application pool recycles clearing in-memory session state
Implementation References
| Language | Constant |
|---|---|
| ASP.NET/IIS | 440 (IIS proprietary) |
| Go | 440 (no standard constant) |
History
Introduced by Microsoft IIS to provide a specific signal for login session timeouts in ASP and ASP.NET applications.
Related Status Codes
Related Headers
FAQ
Should I return 440 in my API?
No. Return 401 Unauthorized when a session has expired. 440 is IIS-specific and not understood by most clients or frameworks outside the Microsoft ecosystem.