How can Electron apps enforce least‑privilege authentication when using expired credentials in a persistent session?

When an Electron application uses a persistent session (e.g., session.fromPartition('persist:auth')) to store authentication cookies or tokens, the framework will automatically send those credentials with outgoing requests unless a custom handler intervenes. If the stored credentials have expired, the app may still leak them to servers, violating least‑privilege principles and potentially causing authentication failures. Developers need a way to detect expired credentials at request time and either suppress them or trigger a refresh flow without recreating the session, because the session’s options cannot be changed after its first use.

How can this be achieved while keeping the rest of the session’s configuration intact?

Specific questions:

• Does Electron automatically filter out expired cookies before attaching them to requests?
• Can a webRequest.onBeforeSendHeaders listener be used to remove or replace expired Authorization headers?
• Is there a supported API to mark credentials as stale within a persistent session so that subsequent requests treat them as invalid?