I started a new browser session, navigated straight to a page with a form on it, then left the page open for a few minutes, when I started filling the form I received a window alert with Your session has expired. Please refresh this page.
Why have I received this and why does the page need to be refreshed?
The form.tracking.js script that ships with Sitecore triggers a POST request on blur of a field if the field has changed. The server-side handler code then checks
if (HttpContext.Session.IsNewSession) {
return content with "Your session has expired. Please refresh this page."
}
the client-side js will then show that message as an alert.
The page likely will need to be refreshed because a new session has started, and therefore the CSRF token will be invalid and the user will get an error trying to submit the form.
In this case if you started a new browser session, the Sitecore robot detection needs to run. If it didn't classify you as human yet, then after some time the session will time out. The default timeout set on Analytics.Robots.SessionTimeout is 1 minute, so this fits the short time frame you're mentioning.