440 Login Time-out

IIS code meaning the client session has expired and the user must sign in again.

Status

HTTP/1.1 440 Login Time-out

Details

Category: 4xx
Status: Unofficial (Microsoft IIS). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

IIS returns 440 when a session times out, typically in ASP.NET applications and Exchange or SharePoint front ends. It is the session equivalent of 401: the credentials were fine, the session that carried them is no longer valid.

Not registered with IANA and not understood outside the Microsoft ecosystem, so generic HTTP clients treat it as an unclassified 4xx.

Common causes

An idle session exceeded its configured timeout.
An application pool recycle discarded in-memory session state.
Session affinity lost behind a load balancer, so the request landed on a server without the session.

How to fix it

As the client

Re-authenticate and replay the request with a fresh session.
For automation, detect 440 and run the login flow again rather than retrying blindly.

As the server

Use a shared session store so recycles and load balancing do not drop sessions.
Return 401 with WWW-Authenticate for clients outside the Microsoft stack.

Examples

GET /owa/inbox HTTP/1.1
Host: mail.example.com

HTTP/1.1 440 Login Time-out