Skip to content

440 Login Time-out

IIS code meaning the client session has expired and the user must sign in again.

Status

HTTP/1.1 440 Login Time-out

Details

  • Category: 4xx
  • Status: Unofficial (Microsoft IIS). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

IIS returns 440 when a session times out, typically in ASP.NET applications and Exchange or SharePoint front ends. It is the session equivalent of 401: the credentials were fine, the session that carried them is no longer valid.

Not registered with IANA and not understood outside the Microsoft ecosystem, so generic HTTP clients treat it as an unclassified 4xx.

Common causes

  • An idle session exceeded its configured timeout.
  • An application pool recycle discarded in-memory session state.
  • Session affinity lost behind a load balancer, so the request landed on a server without the session.

How to fix it

As the client

  • Re-authenticate and replay the request with a fresh session.
  • For automation, detect 440 and run the login flow again rather than retrying blindly.

As the server

  • Use a shared session store so recycles and load balancing do not drop sessions.
  • Return 401 with WWW-Authenticate for clients outside the Microsoft stack.

Examples

An expired IIS session

HTTP request

GET /owa/inbox HTTP/1.1
Host: mail.example.com

HTTP response

HTTP/1.1 440 Login Time-out

See also