diff --git a/dashcaddy-api/routes/auth/sso-gate.js b/dashcaddy-api/routes/auth/sso-gate.js
index e43317f..ef5e64c 100644
--- a/dashcaddy-api/routes/auth/sso-gate.js
+++ b/dashcaddy-api/routes/auth/sso-gate.js
@@ -222,23 +222,33 @@ function buildLoginPage(service) {
   // session and we render the auto-login body; if 401, the meta-refresh kicks
   // in and sends them to status.sami to authenticate first.
   const SHELL = (body) => `<!DOCTYPE html>
-<html><head><meta charset="utf-8"><meta http-equiv="Cache-Control" content="no-store"><title>__TITLE__</title>
-<style>body{background:__BG__;color:#e0e0e0;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:12px}a{color:__ACCENT__}#d{font-size:12px;color:#888;max-width:80vw;overflow:auto;white-space:pre-wrap}</style>
-</head><body><p id="m">__TITLE__</p><div id="d"></div>
-<script>(function(){
-var ls=localStorage,d=document.getElementById('d'),m=document.getElementById('m');
-function go(u){setTimeout(function(){location.replace(u)},300)}
-function fail(msg,info){m.innerHTML=msg;d.textContent=info||''}
-function ft(svc){return fetch('/dashcaddy-api/api/auth/app-token/'+svc,{credentials:'include'})}
-function merge(ck,j,name){try{var c=JSON.parse(ls.getItem(ck)||'{}');if(c.Servers&&c.Servers.length){var s=c.Servers[0];s.AccessToken=j.token;s.UserId=j.userId||s.UserId||'';s.DateLastAccessed=Date.now();ls.setItem(ck,JSON.stringify(c));return}}catch(e){}ls.setItem(ck,JSON.stringify({Servers:[{Id:j.serverId||'',Name:j.serverName||name,UserId:j.userId||'',AccessToken:j.token,ManualAddress:location.origin,LastConnectionMode:2,DateLastAccessed:Date.now()}]}))}
-// Pre-check session before attempting auto-login. If the user is not logged
-// in, redirect to status.sami for TOTP auth first. The return= param sends
-// them back to this login page after authenticating so auto-login can run.
-fetch('/dashcaddy-api/api/auth/totp/check-session',{credentials:'include',cache:'no-store'}).then(function(r){return r.json()}).then(function(st){
-  if(!st||!st.success||!st.authenticated){go('https://status.sami?auth=required&return='+encodeURIComponent(location.href));return}
-${body}
-}).catch(function(e){fail('Could not reach DashCaddy. <a href="https://status.sami?auth=required&return='+encodeURIComponent(location.href)+'">Sign in at DashCaddy</a>','Auth check error: '+e.message)})
-})()</script></body></html>`;
+  <html><head><meta http-equiv="Cache-Control" content="no-store"><title>__TITLE__</title>
+  <style>body{background:__BG__;color:#e0e0e0;font-family:system-ui;display:flex;align-items:center;justify-items:center;height:100vh;margin:0;flex-direction:column;gap:12px}a{color:__ACCENT__}#d{font-size:12px;color:#888;max-width:80vw;overflow:auto;white-wrap:pre-wrap}</style>
+  </head><body><p id="m">__TITLE__</p><div id="d"></div>
+  <script>(function(){
+  var ls=localStorage,d=document.getElementById('d'),m=document.getElementById('m');
+  // 2026-07-22 hardening: every fetch now has a hard AbortSignal timeout
+  // (default 8s) so a hung upstream can NEVER leave the page stuck on
+  // "Signing in to Plex..." indefinitely. Also: if check-session returns
+  // authenticated but app-token fails for any reason (no creds stored,
+  // upstream timeout, etc.), we now ALWAYS redirect to /web/?direct=1 if a
+  // stale token exists in localStorage, instead of failing silently.
+  function go(u){setTimeout(function(){location.replace(u)},300)}
+  function fail(msg,info){try{m.innerHTML=msg;d.textContent=info||''}catch(_){}}
+  function withTimeout(ms){var c=new AbortController();setTimeout(function(){c.abort()},ms);return c.signal}
+  function ft(svc){return fetch('/dashcaddy-api/api/auth/app-token/'+svc,{credentials:'include',signal:withTimeout(8000)})}
+  function merge(ck,j,name){try{var c=JSON.parse(ls.getItem(ck)||'{}');if(c.Servers&&c.Servers.length){var s=c.Servers[0];s.AccessToken=j.token;s.UserId=j.userId||s.UserId||'';s.DateLastAccessed=Date.now();ls.setItem(ck,JSON.stringify(c));return}}catch(e){}ls.setItem(ck,JSON.stringify({Servers:[{Id:j.serverId||'',Name:j.serverName||name,UserId:j.userId||'',AccessToken:j.token,ManualAddress:location.origin,LastConnectionMode:2,DateLastAccessed:Date.now()}]}))}
+  // Belt-and-suspenders hard timeout: if nothing in this script succeeds
+  // within 15s, force-redirect to status.sami so the user can re-auth.
+  var overallTimer=setTimeout(function(){go('https://status.sami?auth=required&return='+encodeURIComponent(location.href))},15000);
+  // Pre-check session before attempting auto-login. If the user is not logged
+  // in, redirect to status.sami for TOTP auth first. The return= param sends
+  // them back to this login page after authenticating so auto-login can run.
+  fetch('/dashcaddy-api/api/auth/totp/check-session',{credentials:'include',cache:'no-store',signal:withTimeout(5000)}).then(function(r){return r.json()}).then(function(st){
+    if(!st||!st.success||!st.authenticated){go('https://status.sami?auth=required&return='+encodeURIComponent(location.href));return}
+  ${body}
+  }).catch(function(e){fail('Could not reach DashCaddy. <a href="https://status.sami?auth=required&return='+encodeURIComponent(location.href)+'">Sign in at DashCaddy</a>','Auth check error: '+(e&&e.message||'unknown'))})
+  })()</script></body></html>`;
 
   const pages = {
     chat: {
