When Keycloak (or other OIDC providers) returns "invalid_grant" during
token refresh (e.g., "Session not active" when the Keycloak session
expires), the session is correctly cleared from the store. However, the
user sees an error page and must manually reload to trigger re-authentication.
Fix: introduce errSessionCleared sentinel error so that getValidatedSession
returns nil session and nil error when a fatal refresh error occurs. This
allows the normal auth flow to redirect the user to the login page seamlessly
instead of showing an error page.
Fixesoauth2-proxy/oauth2-proxy#3402
Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
8be41ba7d2