Can't understand how to work with OpenID protocol using openidConnectClient-1.0 feature and Angular application which using REST API endpoints

Question

So, I have a WAS Liberty server which configured to work with OpenID provider. Then I have an Angular application which heavily using REST Api endpoint. When I first open an application or open it after token has been expired everything is ok, WAS redirects me to OpenID provider and then regular flow defined by OpenID and backed by openidConnectClient-1.0 implementation.

But how do I suppose to care about following use case: token has been expired while the application were open, and user issues GET or POST request without reloading the application? Right now WAS perform redirect too, so I can't actually distinguish between regular response and redirect (both return status 200).

The only solution which I think about is to say to Websphere not to perform redirect for some endpoints but to return 401/403 errors. So I'll be able to monitor response codes in my client side and perform accordingly. Is it possible to achieve? Perhaps there's another solution which I didn't know about?

---

Update: After I've written this I thought about using Authentication Filters, i.e. define something like:

<authFilter id="testFilter">
        <webApp id="simple" matchType="contains" name="simple"/>
        <requestUrl id="excludeUrl1" matchType="notContain" urlPattern="/basic"/>
        <requestUrl id="excludeUrl1" matchType="notContain" urlPattern="/api"/>
    </authFilter>

But I immediately see two drawbacks on this approach:

1. Maintain app's logic in two different places, server.xml and app itself. It'll make maintenance of the application very cumbersome.
2. Due to nature of Authentication Filters it will fallback to another registry to perform login. It potentially can be a security flaw.

Update 2: Solution from above doesn't work. When server returns 401 Error together with www-authenticate header, browser shows popup of basic authentication, see proposed solution below.

Answer 1

To resolve this issue I've used Angular's Interceptors, where I check if there're following headers within the response: no-cache, no-store, must-revalidate, private, max-age=0. If they persist within the response I know that session expired and perform reloading of my application.

While reloading, liberty itself redirect it to SSO provider. Another solution is to extract redirect URL from response and redirect to it manually.