I've had this kind of issue sometime back and especially on MW-Vagrant instances. I've not had it on an actual wiki anyway. So resubmitting will work only if it was a session timeout (as you rightly mentioned). So just changing sessionfailure system message can be a little confusing if the above mentioned case is not what is happening. Maybe it could be better to check what the issue is in the codes the return the appropriate error?

Meaning if it's not a session timeout, then the appropriate message should be returned rather than tell the user to resubmit the form when it won't work? What do you think @Tgr?

How do you tell if it's a session timeout or not? As far as MediaWiki is concerned, usually it's the same situation: the user submitted a CSRF token but there isn't one in their session. Maybe SessionManager can be changed to say whether the backend session existed at the start of the request; in any case, that's a more complex problem and should probably be a separate task.

Change 407403 had a related patch set uploaded (by D3r1ck01; owner: Alangi Derick):
[mediawiki/core@master] Fixes to sessionfailure message during authentication

https://gerrit.wikimedia.org/r/407403

@Tgr, I've submitted a patch. Detecting if it's a session timeout or other will be another task that I've filled here: T186249.

Change 407403 merged by jenkins-bot:
[mediawiki/core@master] Fix sessionfailure i18n message during authentication

https://gerrit.wikimedia.org/r/407403