I’m not generally a fan of session timeouts, but if you have to do it, Léonie Watson has outlined a pretty good route to go. My only nit might be using a
role of “alert” or “alertdialog” instead of “group”, but that’s because it would trigger an audible chime and get read by assistive tech. But that’s pretty minor.
Pay particular attention to the keyboard focus stuff too.