diff --git a/lib/types/media-types.js b/lib/types/media-types.js
index f1af87083..4b84f90fe 100644
--- a/lib/types/media-types.js
+++ b/lib/types/media-types.js
@@ -1,823 +1,824 @@
 // @flow
 
 import t, { type TInterface, type TUnion } from 'tcomb';
 
 import type { ClientEncryptedImageAvatar } from './avatar-types';
 import { type Platform } from './device-types.js';
 import { tShape, tString, tID } from '../utils/validation-utils.js';
 
 export type Dimensions = $ReadOnly<{
   +height: number,
   +width: number,
 }>;
 
 export const dimensionsValidator: TInterface<Dimensions> = tShape<Dimensions>({
   height: t.Number,
   width: t.Number,
 });
 
 export type MediaType = 'photo' | 'video';
 const mediaTypeValidator = t.enums.of(['photo', 'video']);
 
 export type EncryptedMediaType = 'encrypted_photo' | 'encrypted_video';
 
 export type AvatarMediaInfo =
   | ClientEncryptedImageAvatar
   | {
       +type: 'photo',
       +uri: string,
     };
 
 export type ClientDBMediaInfo = {
   +id: string,
   +uri: string,
   +type: 'photo' | 'video',
   +extras: string,
 };
 
 export type Corners = Partial<{
   +topLeft: boolean,
   +topRight: boolean,
   +bottomLeft: boolean,
   +bottomRight: boolean,
 }>;
 
 export type MediaInfo =
   | {
       ...Image,
       +index: number,
     }
   | {
       ...Video,
       +index: number,
     }
   | {
       ...EncryptedImage,
       +index: number,
     }
   | {
       ...EncryptedVideo,
       +index: number,
     };
 
 export type UploadMultimediaResult = {
   +id: string,
   +uri: string,
   +dimensions: Dimensions,
   +mediaType: MediaType,
   +loop: boolean,
 };
 export const uploadMultimediaResultValidator: TInterface<UploadMultimediaResult> =
   tShape<UploadMultimediaResult>({
     id: tID,
     uri: t.String,
     dimensions: dimensionsValidator,
     mediaType: mediaTypeValidator,
     loop: t.Boolean,
   });
 
 export type UpdateMultimediaMessageMediaPayload = {
   +messageID: string,
   +currentMediaID: string,
   +mediaUpdate: MediaShape,
 };
 
 export type UploadDeletionRequest = {
   +id: string,
 };
 
 export type UploadMediaMetadataRequest = {
   ...Dimensions,
   +filename: string,
   +blobHolder: string,
   +blobHash: string,
   +encryptionKey: string,
   +mimeType: string,
   +loop?: boolean,
   +thumbHash?: string,
 };
 
 export type FFmpegStatistics = {
   // seconds of video being processed per second
   +speed: number,
   // total milliseconds of video processed so far
   +time: number,
   // total result file size in bytes so far
   +size: number,
   +videoQuality: number,
   +videoFrameNumber: number,
   +videoFps: number,
   +bitrate: number,
 };
 
 export type TranscodeVideoMediaMissionStep = {
   +step: 'video_ffmpeg_transcode',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +returnCode: ?number,
   +newPath: ?string,
   +stats: ?FFmpegStatistics,
 };
 
 export type VideoGenerateThumbnailMediaMissionStep = {
   +step: 'video_generate_thumbnail',
   +success: boolean,
   +time: number, // ms
   +returnCode: number,
   +thumbnailURI: string,
 };
 
 export type VideoInfo = {
   +codec: ?string,
   +dimensions: ?Dimensions,
   +duration: number, // seconds
   +format: $ReadOnlyArray<string>,
 };
 
 export type VideoProbeMediaMissionStep = {
   +step: 'video_probe',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +path: string,
   +validFormat: boolean,
   +duration: ?number, // seconds
   +codec: ?string,
   +format: ?$ReadOnlyArray<string>,
   +dimensions: ?Dimensions,
 };
 
 export type ReadFileHeaderMediaMissionStep = {
   +step: 'read_file_header',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +uri: string,
   +mime: ?string,
   +mediaType: ?MediaType,
 };
 
 export type DetermineFileTypeMediaMissionStep = {
   +step: 'determine_file_type',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +inputFilename: string,
   +outputMIME: ?string,
   +outputMediaType: ?MediaType,
   +outputFilename: ?string,
 };
 
 export type FrameCountMediaMissionStep = {
   +step: 'frame_count',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number,
   +path: string,
   +mime: string,
   +hasMultipleFrames: ?boolean,
 };
 
 export type DisposeTemporaryFileMediaMissionStep = {
   +step: 'dispose_temporary_file',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +path: string,
 };
 
 export type MakeDirectoryMediaMissionStep = {
   +step: 'make_directory',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +path: string,
 };
 
 export type AndroidScanFileMediaMissionStep = {
   +step: 'android_scan_file',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +path: string,
 };
 
 export type FetchFileHashMediaMissionStep = {
   +step: 'fetch_file_hash',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +path: string,
   +hash: ?string,
 };
 
 export type CopyFileMediaMissionStep = {
   +step: 'copy_file',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +source: string,
   +destination: string,
 };
 
 export type GetOrientationMediaMissionStep = {
   +step: 'exif_fetch',
   +success: boolean,
   +exceptionMessage: ?string,
   +time: number, // ms
   +orientation: ?number,
 };
 
 export type GenerateThumbhashMediaMissionStep = {
   +step: 'generate_thumbhash',
   +success: boolean,
   +exceptionMessage: ?string,
   +thumbHash: ?string,
 };
 
 export type EncryptFileMediaMissionStep =
   | {
       +step: 'read_plaintext_file',
       +file: string,
       +time: number, // ms
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'encrypt_data',
       +dataSize: number,
       +time: number, // ms
       +isPadded: boolean,
       +sha256: ?string,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'write_encrypted_file',
       +file: string,
       +time: number, // ms
       +success: boolean,
       +exceptionMessage: ?string,
     };
 
 export type DecryptFileMediaMissionStep =
   | {
       +step: 'fetch_file',
       +file: string,
       +time: number,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'decrypt_data',
       +dataSize: number,
       +time: number,
       +isPadded: boolean,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'write_file',
       +file: string,
       +mimeType: string,
       +time: number,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'create_data_uri',
       +mimeType: string,
       +time: number,
       +success: boolean,
       +exceptionMessage: ?string,
     };
 
 export type MediaLibrarySelection =
   | {
       +step: 'photo_library',
       +dimensions: Dimensions,
       +filename: ?string,
       +uri: string,
       +mediaNativeID: ?string,
       +selectTime: number, // ms timestamp
       +sendTime: number, // ms timestamp
       +retries: number,
     }
   | {
       +step: 'video_library',
       +dimensions: Dimensions,
       +filename: ?string,
       +uri: string,
       +mediaNativeID: ?string,
       +selectTime: number, // ms timestamp
       +sendTime: number, // ms timestamp
       +retries: number,
       +duration: number, // seconds
     };
 
 export const mediaLibrarySelectionValidator: TUnion<MediaLibrarySelection> =
   t.union([
     tShape({
       step: tString('photo_library'),
       dimensions: dimensionsValidator,
       filename: t.maybe(t.String),
       uri: t.String,
       mediaNativeID: t.maybe(t.String),
       selectTime: t.Number,
       sendTime: t.Number,
       retries: t.Number,
     }),
     tShape({
       step: tString('video_library'),
       dimensions: dimensionsValidator,
       filename: t.maybe(t.String),
       uri: t.String,
       mediaNativeID: t.maybe(t.String),
       selectTime: t.Number,
       sendTime: t.Number,
       retries: t.Number,
       duration: t.Number,
     }),
   ]);
 
 export type PhotoCapture = {
   +step: 'photo_capture',
   +time: number, // ms
   +dimensions: Dimensions,
   +filename: string,
   +uri: string,
   +captureTime: number, // ms timestamp
   +selectTime: number, // ms timestamp
   +sendTime: number, // ms timestamp
   +retries: number,
 };
 
 export const photoCaptureValidator: TInterface<PhotoCapture> =
   tShape<PhotoCapture>({
     step: tString('photo_capture'),
     time: t.Number,
     dimensions: dimensionsValidator,
     filename: t.String,
     uri: t.String,
     captureTime: t.Number,
     selectTime: t.Number,
     sendTime: t.Number,
     retries: t.Number,
   });
 
 export type PhotoPaste = {
   +step: 'photo_paste',
   +dimensions: Dimensions,
   +filename: string,
   +uri: string,
   +selectTime: number, // ms timestamp
   +sendTime: number, // ms timestamp
   +retries: number,
 };
 
 export const photoPasteValidator: TInterface<PhotoPaste> = tShape<PhotoPaste>({
   step: tString('photo_paste'),
   dimensions: dimensionsValidator,
   filename: t.String,
   uri: t.String,
   selectTime: t.Number,
   sendTime: t.Number,
   retries: t.Number,
 });
 
 export type NativeMediaSelection =
   | MediaLibrarySelection
   | PhotoCapture
   | PhotoPaste;
 
 export const nativeMediaSelectionValidator: TUnion<NativeMediaSelection> =
   t.union([
     mediaLibrarySelectionValidator,
     photoCaptureValidator,
     photoPasteValidator,
   ]);
 
 export type MediaMissionStep =
   | NativeMediaSelection
   | {
       +step: 'web_selection',
       +filename: string,
       +size: number, // in bytes
       +mime: string,
       +selectTime: number, // ms timestamp
     }
   | {
       +step: 'asset_info_fetch',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +localURI: ?string,
       +orientation: ?number,
     }
   | {
       +step: 'stat_file',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +uri: string,
       +fileSize: ?number,
     }
   | ReadFileHeaderMediaMissionStep
   | DetermineFileTypeMediaMissionStep
   | FrameCountMediaMissionStep
   | {
       +step: 'photo_manipulation',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +manipulation: Object,
       +newMIME: ?string,
       +newDimensions: ?Dimensions,
       +newURI: ?string,
     }
   | VideoProbeMediaMissionStep
   | TranscodeVideoMediaMissionStep
   | VideoGenerateThumbnailMediaMissionStep
   | DisposeTemporaryFileMediaMissionStep
   | {
       +step: 'save_media',
       +uri: string,
       +time: number, // ms timestamp
     }
   | {
       +step: 'permissions_check',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +platform: Platform,
       +permissions: $ReadOnlyArray<string>,
     }
   | MakeDirectoryMediaMissionStep
   | AndroidScanFileMediaMissionStep
   | {
       +step: 'ios_save_to_library',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +uri: string,
     }
   | {
       +step: 'fetch_blob',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +inputURI: string,
       +uri: string,
       +size: ?number,
       +mime: ?string,
     }
   | {
       +step: 'data_uri_from_blob',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +first255Chars: ?string,
     }
   | {
       +step: 'array_buffer_from_blob',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
     }
   | {
       +step: 'mime_check',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +mime: ?string,
     }
   | {
       +step: 'write_file',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +path: string,
       +length: number,
     }
   | FetchFileHashMediaMissionStep
   | CopyFileMediaMissionStep
   | EncryptFileMediaMissionStep
   | DecryptFileMediaMissionStep
   | GetOrientationMediaMissionStep
   | GenerateThumbhashMediaMissionStep
   | {
       +step: 'preload_resource',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +uri: string,
     }
   | {
       +step: 'preload_image',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +uri: string,
       +dimensions: ?Dimensions,
     }
   | {
       +step: 'reorient_image',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +uri: ?string,
     }
   | {
       +step: 'upload',
       +success: boolean,
       +exceptionMessage: ?string,
       +time: number, // ms
       +inputFilename: string,
       +outputMediaType: ?MediaType,
       +outputURI: ?string,
       +outputDimensions: ?Dimensions,
       +outputLoop: ?boolean,
       +hasWiFi?: boolean,
     }
   | {
       +step: 'wait_for_capture_uri_unload',
       +success: boolean,
       +time: number, // ms
       +uri: string,
     };
 
 export type MediaMissionFailure =
   | {
       +success: false,
       +reason: 'no_file_path',
     }
   | {
       +success: false,
       +reason: 'file_stat_failed',
       +uri: string,
     }
   | {
       +success: false,
       +reason: 'photo_manipulation_failed',
       +size: number, // in bytes
     }
   | {
       +success: false,
       +reason: 'media_type_fetch_failed',
       +detectedMIME: ?string,
     }
   | {
       +success: false,
       +reason: 'mime_type_mismatch',
       +reportedMediaType: MediaType,
       +reportedMIME: string,
       +detectedMIME: string,
     }
   | {
       +success: false,
       +reason: 'http_upload_failed',
       +exceptionMessage: ?string,
     }
   | {
       +success: false,
       +reason: 'video_too_long',
       +duration: number, // in seconds
     }
   | {
       +success: false,
       +reason: 'video_probe_failed',
     }
   | {
       +success: false,
       +reason: 'video_transcode_failed',
     }
   | {
       +success: false,
       +reason: 'video_generate_thumbnail_failed',
     }
   | {
       +success: false,
       +reason: 'processing_exception',
       +time: number, // ms
       +exceptionMessage: ?string,
     }
   | {
       +success: false,
       +reason: 'encryption_exception',
       +time: number, // ms
       +exceptionMessage: ?string,
     }
   | {
       +success: false,
       +reason: 'save_unsupported',
     }
   | {
       +success: false,
       +reason: 'missing_permission',
     }
   | {
       +success: false,
       +reason: 'make_directory_failed',
     }
   | {
       +success: false,
       +reason: 'resolve_failed',
       +uri: string,
     }
   | {
       +success: false,
       +reason: 'save_to_library_failed',
       +uri: string,
     }
   | {
       +success: false,
       +reason: 'fetch_failed',
     }
   | {
       +success: false,
       +reason: 'data_uri_failed',
     }
   | {
       +success: false,
       +reason: 'array_buffer_failed',
     }
   | {
       +success: false,
       +reason: 'mime_check_failed',
       +mime: ?string,
     }
   | {
       +success: false,
       +reason: 'write_file_failed',
     }
   | {
       +success: false,
       +reason: 'fetch_file_hash_failed',
     }
   | {
       +success: false,
       +reason: 'copy_file_failed',
     }
   | {
       +success: false,
       +reason: 'exif_fetch_failed',
     }
   | {
       +success: false,
       +reason: 'reorient_image_failed',
     }
   | {
       +success: false,
       +reason: 'web_sibling_validation_failed',
     }
   | {
       +success: false,
       +reason: 'encryption_failed',
     }
   | { +success: false, +reason: 'digest_failed' }
   | { +success: false, +reason: 'thumbhash_failed' }
   | { +success: false, +reason: 'preload_image_failed' }
+  | { +success: false, +reason: 'invalid_csat' }
   | DecryptionFailure;
 
 export type DecryptionFailure = {
   +success: false,
   +reason: 'fetch_file_failed' | 'decrypt_data_failed' | 'write_file_failed',
   +exceptionMessage: ?string,
 };
 
 export type MediaMissionResult = MediaMissionFailure | { +success: true };
 
 export type MediaMission = {
   +steps: $ReadOnlyArray<MediaMissionStep>,
   +result: MediaMissionResult,
   +userTime: number,
   +totalTime: number,
 };
 
 export type Image = {
   +id: string,
   +uri: string,
   +type: 'photo',
   +dimensions: Dimensions,
   +thumbHash: ?string,
   // stored on native only during creation in case retry needed after state lost
   +localMediaSelection?: NativeMediaSelection,
 };
 
 export const imageValidator: TInterface<Image> = tShape<Image>({
   id: tID,
   uri: t.String,
   type: tString('photo'),
   dimensions: dimensionsValidator,
   thumbHash: t.maybe(t.String),
   localMediaSelection: t.maybe(nativeMediaSelectionValidator),
 });
 
 type EncryptedImageCommons = {
   +id: string,
   +encryptionKey: string,
   +type: 'encrypted_photo',
   +dimensions: Dimensions,
   +thumbHash: ?string,
 };
 // old message formats (native codeVersion < 341) used holder
 // new format uses blobURI. Effectively, they both mean blob URI
 export type EncryptedImage =
   | { ...EncryptedImageCommons, +holder: string }
   | { ...EncryptedImageCommons, +blobURI: string };
 
 const encryptedImageCommonsValidator = {
   id: tID,
   encryptionKey: t.String,
   type: tString('encrypted_photo'),
   dimensions: dimensionsValidator,
   thumbHash: t.maybe(t.String),
 };
 
 const encryptedImageValidator = t.union<EncryptedImage>([
   tShape({ ...encryptedImageCommonsValidator, holder: t.String }),
   tShape({ ...encryptedImageCommonsValidator, blobURI: t.String }),
 ]);
 
 export type Video = {
   +id: string,
   +uri: string,
   +type: 'video',
   +dimensions: Dimensions,
   +loop?: boolean,
   +thumbnailID: string,
   +thumbnailURI: string,
   +thumbnailThumbHash: ?string,
   // stored on native only during creation in case retry needed after state lost
   +localMediaSelection?: NativeMediaSelection,
 };
 
 export const videoValidator: TInterface<Video> = tShape<Video>({
   id: tID,
   uri: t.String,
   type: tString('video'),
   dimensions: dimensionsValidator,
   loop: t.maybe(t.Boolean),
   thumbnailID: tID,
   thumbnailURI: t.String,
   thumbnailThumbHash: t.maybe(t.String),
   localMediaSelection: t.maybe(nativeMediaSelectionValidator),
 });
 
 type EncryptedVideoCommons = {
   +id: string,
   +encryptionKey: string,
   +type: 'encrypted_video',
   +dimensions: Dimensions,
   +loop?: boolean,
   +thumbnailID: string,
   +thumbnailEncryptionKey: string,
   +thumbnailThumbHash: ?string,
 };
 // old message formats (native codeVersion < 341) used holder
 // new format uses blobURI. Effectively, they both mean blob URI
 export type EncryptedVideo =
   | { ...EncryptedVideoCommons, +holder: string, +thumbnailHolder: string }
   | { ...EncryptedVideoCommons, +blobURI: string, +thumbnailBlobURI: string };
 
 const encryptedVideoCommonsValidator = {
   id: tID,
   encryptionKey: t.String,
   type: tString('encrypted_video'),
   dimensions: dimensionsValidator,
   loop: t.maybe(t.Boolean),
   thumbnailID: tID,
   thumbnailEncryptionKey: t.String,
   thumbnailThumbHash: t.maybe(t.String),
 };
 const encryptedVideoValidator = t.union<EncryptedVideo>([
   tShape({
     ...encryptedVideoCommonsValidator,
     holder: t.String,
     thumbnailHolder: t.String,
   }),
   tShape({
     ...encryptedVideoCommonsValidator,
     blobURI: t.String,
     thumbnailBlobURI: t.String,
   }),
 ]);
 
 export type Media = Image | Video | EncryptedImage | EncryptedVideo;
 export type MediaShape =
   | Partial<Image>
   | Partial<Video>
   | Partial<EncryptedImage>
   | Partial<EncryptedVideo>;
 
 export const mediaValidator: TUnion<Media> = t.union([
   imageValidator,
   videoValidator,
   encryptedImageValidator,
   encryptedVideoValidator,
 ]);
 
 export type MultimediaUploadResult = {
   results: UploadMultimediaResult[],
 };
diff --git a/native/media/encryption-utils.js b/native/media/encryption-utils.js
index bf7a55e5f..485d62a7c 100644
--- a/native/media/encryption-utils.js
+++ b/native/media/encryption-utils.js
@@ -1,464 +1,478 @@
 // @flow
 
 import invariant from 'invariant';
 import * as React from 'react';
 
+import { useInvalidCSATLogOut } from 'lib/actions/user-actions.js';
 import { uintArrayToHexString, hexToUintArray } from 'lib/media/data-utils.js';
 import {
   replaceExtension,
   fileInfoFromData,
   filenameFromPathOrURI,
   readableFilename,
   pathFromURI,
 } from 'lib/media/file-utils.js';
 import type { AuthMetadata } from 'lib/shared/identity-client-context.js';
 import { IdentityClientContext } from 'lib/shared/identity-client-context.js';
 import type {
   MediaMissionFailure,
   MediaMissionStep,
   DecryptFileMediaMissionStep,
   EncryptFileMediaMissionStep,
 } from 'lib/types/media-types.js';
 import { isBlobServiceURI } from 'lib/utils/blob-service.js';
 import { getMessageForException } from 'lib/utils/errors.js';
 import { pad, unpad, calculatePaddedLength } from 'lib/utils/pkcs7-padding.js';
 import {
   createDefaultHTTPRequestHeaders,
   usingCommServicesAccessToken,
+  httpResponseIsInvalidCSAT,
 } from 'lib/utils/services-utils.js';
 
 import { temporaryDirectoryPath } from './file-utils.js';
 import { getFetchableURI } from './identifier-utils.js';
 import type { MediaResult } from './media-utils.js';
 import { commUtilsModule } from '../native-modules.js';
 import * as AES from '../utils/aes-crypto-module.js';
 import { arrayBufferFromBlob } from '../utils/blob-utils-module.js';
 
 const PADDING_THRESHOLD = 5000000; // we don't pad files larger than this
 
 type EncryptedFileResult = {
   +success: true,
   +uri: string,
   +sha256Hash: string,
   +encryptionKey: string,
 };
 
 /**
  * Encrypts a single file and returns the encrypted file URI
  * and the encryption key. The encryption key is returned as a hex string.
  * The encrypted file is written to the same directory as the original file,
  * with the same name, but with the extension ".dat".
  *
  * @param uri uri to the file to encrypt
  * @returns encryption result along with mission steps
  */
 async function encryptFile(uri: string): Promise<{
   steps: $ReadOnlyArray<EncryptFileMediaMissionStep>,
   result: MediaMissionFailure | EncryptedFileResult,
 }> {
   let success = true,
     exceptionMessage;
   const steps: EncryptFileMediaMissionStep[] = [];
 
   // prepare destination path for temporary encrypted file
   const originalFilename = filenameFromPathOrURI(uri);
   invariant(originalFilename, 'encryptFile: Invalid URI - filename is null');
   const targetFilename = replaceExtension(originalFilename, 'dat');
   const destinationPath = `${temporaryDirectoryPath}${targetFilename}`;
   const destinationURI = `file://${destinationPath}`;
 
   // Step 1. Read the file
   const startOpenFile = Date.now();
   let data;
   try {
     const path = pathFromURI(uri);
     // for local paths (file:// URI) we can use native module which is faster
     if (path) {
       const buffer = await commUtilsModule.readBufferFromFile(path);
       data = new Uint8Array(buffer);
     } else {
       const response = await fetch(getFetchableURI(uri));
       const blob = await response.blob();
       const buffer = arrayBufferFromBlob(blob);
       data = new Uint8Array(buffer);
     }
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'read_plaintext_file',
     file: uri,
     time: Date.now() - startOpenFile,
     success,
     exceptionMessage,
   });
   if (!success || !data) {
     return {
       steps,
       result: { success: false, reason: 'fetch_failed' },
     };
   }
 
   // Step 2. Encrypt the file
   const startEncrypt = Date.now();
   const paddedLength = calculatePaddedLength(data.byteLength);
   const shouldPad = paddedLength <= PADDING_THRESHOLD;
   let key, encryptedData, sha256Hash;
   try {
     const plaintextData = shouldPad ? pad(data) : data;
     key = AES.generateKey();
     encryptedData = AES.encrypt(key, plaintextData);
     sha256Hash = commUtilsModule.sha256(encryptedData.buffer);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'encrypt_data',
     dataSize: encryptedData?.byteLength ?? -1,
     isPadded: shouldPad,
     time: Date.now() - startEncrypt,
     sha256: sha256Hash,
     success,
     exceptionMessage,
   });
   if (encryptedData && !sha256Hash) {
     return { steps, result: { success: false, reason: 'digest_failed' } };
   }
   if (!success || !encryptedData || !key || !sha256Hash) {
     return {
       steps,
       result: { success: false, reason: 'encryption_failed' },
     };
   }
 
   // Step 3. Write the encrypted file
   const startWriteFile = Date.now();
   try {
     await commUtilsModule.writeBufferToFile(
       destinationPath,
       encryptedData.buffer,
     );
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'write_encrypted_file',
     file: destinationPath,
     time: Date.now() - startWriteFile,
     success,
     exceptionMessage,
   });
   if (!success) {
     return {
       steps,
       result: { success: false, reason: 'write_file_failed' },
     };
   }
 
   return {
     steps,
     result: {
       success: true,
       uri: destinationURI,
       encryptionKey: uintArrayToHexString(key),
       sha256Hash,
     },
   };
 }
 
 /**
  * Encrypts a single photo or video. Replaces the uploadURI with the encrypted
  * file URI. Attaches `encryptionKey` to the result. Changes the mediaType to
  * `encrypted_photo` or `encrypted_video`.
  *
  * @param preprocessedMedia - Result of `processMedia()` call
  * @returns a `preprocessedMedia` param, but with encryption applied
  */
 async function encryptMedia(preprocessedMedia: MediaResult): Promise<{
   result: MediaResult | MediaMissionFailure,
   steps: $ReadOnlyArray<MediaMissionStep>,
 }> {
   invariant(preprocessedMedia.success, 'encryptMedia called on failure result');
   invariant(
     preprocessedMedia.mediaType === 'photo' ||
       preprocessedMedia.mediaType === 'video',
     'encryptMedia should only be called on unencrypted photos and videos',
   );
   const { uploadURI } = preprocessedMedia;
   const steps: Array<MediaMissionStep> = [];
 
   // Encrypt the media file
   const { steps: encryptionSteps, result: encryptionResult } =
     await encryptFile(uploadURI);
   steps.push(...encryptionSteps);
 
   if (!encryptionResult.success) {
     return { steps, result: encryptionResult };
   }
 
   if (preprocessedMedia.mediaType === 'photo') {
     const thumbHashResult = preprocessedMedia.thumbHash
       ? encryptBase64(
           preprocessedMedia.thumbHash,
           hexToUintArray(encryptionResult.encryptionKey),
         )
       : null;
     return {
       steps,
       result: {
         ...preprocessedMedia,
         mediaType: 'encrypted_photo',
         uploadURI: encryptionResult.uri,
         blobHash: encryptionResult.sha256Hash,
         thumbHash: thumbHashResult?.base64,
         encryptionKey: encryptionResult.encryptionKey,
         shouldDisposePath: pathFromURI(encryptionResult.uri),
       },
     };
   }
 
   // For videos, we also need to encrypt the thumbnail
   const { steps: thumbnailEncryptionSteps, result: thumbnailEncryptionResult } =
     await encryptFile(preprocessedMedia.uploadThumbnailURI);
   steps.push(...thumbnailEncryptionSteps);
 
   if (!thumbnailEncryptionResult.success) {
     return { steps, result: thumbnailEncryptionResult };
   }
 
   const thumbHashResult = preprocessedMedia.thumbHash
     ? encryptBase64(
         preprocessedMedia.thumbHash,
         hexToUintArray(thumbnailEncryptionResult.encryptionKey),
       )
     : null;
 
   return {
     steps,
     result: {
       ...preprocessedMedia,
       mediaType: 'encrypted_video',
       uploadURI: encryptionResult.uri,
       blobHash: encryptionResult.sha256Hash,
       thumbHash: thumbHashResult?.base64,
       encryptionKey: encryptionResult.encryptionKey,
       uploadThumbnailURI: thumbnailEncryptionResult.uri,
       thumbnailBlobHash: thumbnailEncryptionResult.sha256Hash,
       thumbnailEncryptionKey: thumbnailEncryptionResult.encryptionKey,
       shouldDisposePath: pathFromURI(encryptionResult.uri),
     },
   };
 }
 
 type FetchAndDecryptMediaOptions = {
   +destination: 'file' | 'data_uri',
   +destinationDirectory?: string,
 };
 
 type FetchAndDecryptMediaOutput = {
   steps: $ReadOnlyArray<DecryptFileMediaMissionStep>,
   result: MediaMissionFailure | { success: true, uri: string },
 };
 
 async function fetchAndDecryptMedia(
   blobURI: string,
   encryptionKey: string,
   authMetadata: ?AuthMetadata,
   options: FetchAndDecryptMediaOptions,
 ): Promise<FetchAndDecryptMediaOutput> {
   let success = true,
     exceptionMessage;
   const steps: DecryptFileMediaMissionStep[] = [];
 
   // Step 1. Fetch the file and convert it to a Uint8Array
+  const isBlobServiceHosted = isBlobServiceURI(blobURI);
+
   let headers;
-  if (isBlobServiceURI(blobURI) && authMetadata) {
+  if (isBlobServiceHosted && authMetadata) {
     headers = createDefaultHTTPRequestHeaders(authMetadata);
   }
 
   const fetchStartTime = Date.now();
   let data;
   try {
     const response = await fetch(getFetchableURI(blobURI), { headers });
     if (!response.ok) {
+      if (isBlobServiceHosted && httpResponseIsInvalidCSAT(response)) {
+        return { steps, result: { success: false, reason: 'invalid_csat' } };
+      }
       throw new Error(`HTTP error ${response.status}: ${response.statusText}`);
     }
     const blob = await response.blob();
     const buffer = arrayBufferFromBlob(blob);
     data = new Uint8Array(buffer);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'fetch_file',
     file: blobURI,
     time: Date.now() - fetchStartTime,
     success,
     exceptionMessage,
   });
   if (!success || !data) {
     return {
       steps,
       result: { success: false, reason: 'fetch_file_failed', exceptionMessage },
     };
   }
 
   // Step 2. Decrypt the data
   const decryptionStartTime = Date.now();
   let plaintextData, decryptedData, isPadded;
   try {
     const key = hexToUintArray(encryptionKey);
     plaintextData = AES.decrypt(key, data);
     isPadded = plaintextData.byteLength <= PADDING_THRESHOLD;
     decryptedData = isPadded ? unpad(plaintextData) : plaintextData;
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'decrypt_data',
     dataSize: decryptedData?.byteLength ?? -1,
     isPadded: !!isPadded,
     time: Date.now() - decryptionStartTime,
     success,
     exceptionMessage,
   });
 
   if (!success || !decryptedData) {
     return {
       steps,
       result: {
         success: false,
         reason: 'decrypt_data_failed',
         exceptionMessage,
       },
     };
   }
 
   // Step 3. Write the file to disk or create a data URI
   let uri;
   const writeStartTime = Date.now();
   // we need extension for react-native-video to work
   const { mime } = fileInfoFromData(decryptedData);
   if (!mime) {
     return {
       steps,
       result: {
         success: false,
         reason: 'mime_check_failed',
         mime,
       },
     };
   }
   if (options.destination === 'file') {
     // blobURI is a URL, we use the last part of the path as the filename
     const uriSuffix = blobURI.substring(blobURI.lastIndexOf('/') + 1);
     const filename = readableFilename(uriSuffix, mime) || uriSuffix;
     const directory = options.destinationDirectory ?? temporaryDirectoryPath;
     const targetPath = `${directory}${Date.now()}-${filename}`;
     try {
       await commUtilsModule.writeBufferToFile(targetPath, decryptedData.buffer);
     } catch (e) {
       success = false;
       exceptionMessage = getMessageForException(e);
     }
     uri = `file://${targetPath}`;
     steps.push({
       step: 'write_file',
       file: uri,
       mimeType: mime,
       time: Date.now() - writeStartTime,
       success,
       exceptionMessage,
     });
     if (!success) {
       return {
         steps,
         result: {
           success: false,
           reason: 'write_file_failed',
           exceptionMessage,
         },
       };
     }
   } else {
     const base64 = commUtilsModule.base64EncodeBuffer(decryptedData.buffer);
     uri = `data:${mime};base64,${base64}`;
     steps.push({
       step: 'create_data_uri',
       mimeType: mime,
       time: Date.now() - writeStartTime,
       success,
       exceptionMessage,
     });
   }
 
   return {
     steps,
     result: { success: true, uri },
   };
 }
 
 function useFetchAndDecryptMedia(): (
   blobURI: string,
   encryptionKey: string,
   options: FetchAndDecryptMediaOptions,
 ) => Promise<FetchAndDecryptMediaOutput> {
   const identityContext = React.useContext(IdentityClientContext);
   invariant(identityContext, 'Identity context should be set');
   const { getAuthMetadata } = identityContext;
 
+  const invalidTokenLogOut = useInvalidCSATLogOut();
+
   return React.useCallback(
     async (blobURI, encryptionKey, options) => {
       let authMetadata;
       if (usingCommServicesAccessToken) {
         try {
           authMetadata = await getAuthMetadata();
         } catch (err) {
           console.warn('Failed to get auth metadata:', err);
         }
       }
-      return fetchAndDecryptMedia(
+      const output = await fetchAndDecryptMedia(
         blobURI,
         encryptionKey,
         authMetadata,
         options,
       );
+
+      if (!output.result.success && output.result.reason === 'invalid_csat') {
+        void invalidTokenLogOut();
+      }
+      return output;
     },
-    [getAuthMetadata],
+    [getAuthMetadata, invalidTokenLogOut],
   );
 }
 
 function encryptBase64(
   base64: string,
   keyBytes?: Uint8Array,
 ): { +base64: string, +keyHex: string } {
   const rawData = commUtilsModule.base64DecodeBuffer(base64);
   const aesKey = keyBytes ?? AES.generateKey();
   const encrypted = AES.encrypt(aesKey, new Uint8Array(rawData));
   return {
     base64: commUtilsModule.base64EncodeBuffer(encrypted.buffer),
     keyHex: uintArrayToHexString(aesKey),
   };
 }
 
 function decryptBase64(encrypted: string, keyHex: string): string {
   const encryptedData = commUtilsModule.base64DecodeBuffer(encrypted);
   const decryptedData = AES.decrypt(
     hexToUintArray(keyHex),
     new Uint8Array(encryptedData),
   );
   return commUtilsModule.base64EncodeBuffer(decryptedData.buffer);
 }
 
 export {
   encryptMedia,
   fetchAndDecryptMedia,
   useFetchAndDecryptMedia,
   encryptBase64,
   decryptBase64,
 };
diff --git a/native/media/save-media.js b/native/media/save-media.js
index 98b4d9683..291354278 100644
--- a/native/media/save-media.js
+++ b/native/media/save-media.js
@@ -1,548 +1,553 @@
 // @flow
 
 import * as MediaLibrary from 'expo-media-library';
 import invariant from 'invariant';
 import * as React from 'react';
 import { Platform, PermissionsAndroid } from 'react-native';
 import filesystem from 'react-native-fs';
 
 import { queueReportsActionType } from 'lib/actions/report-actions.js';
+import { useInvalidCSATLogOut } from 'lib/actions/user-actions.js';
 import { readableFilename, pathFromURI } from 'lib/media/file-utils.js';
 import { isLocalUploadID } from 'lib/media/media-utils.js';
 import type {
   MediaMissionStep,
   MediaMissionResult,
   MediaMissionFailure,
   MediaInfo,
 } from 'lib/types/media-types.js';
 import {
   reportTypes,
   type ClientMediaMissionReportCreationRequest,
 } from 'lib/types/report-types.js';
 import { isBlobServiceURI } from 'lib/utils/blob-service.js';
 import { getConfig } from 'lib/utils/config.js';
 import { getMessageForException } from 'lib/utils/errors.js';
 import { useDispatch } from 'lib/utils/redux-utils.js';
 import {
   generateReportID,
   useIsReportEnabled,
 } from 'lib/utils/report-utils.js';
 
 import { fetchBlob } from './blob-utils.js';
 import { fetchAndDecryptMedia } from './encryption-utils.js';
 import {
   fetchAssetInfo,
   fetchFileInfo,
   disposeTempFile,
   mkdir,
   androidScanFile,
   fetchFileHash,
   copyFile,
   temporaryDirectoryPath,
   type FetchFileInfoResult,
 } from './file-utils.js';
 import { getMediaLibraryIdentifier } from './identifier-utils.js';
 import { commCoreModule } from '../native-modules.js';
 import { displayActionResultModal } from '../navigation/action-result-modal.js';
 import { requestAndroidPermission } from '../utils/android-permissions.js';
 
 export type IntentionalSaveMedia = (
   mediaInfo: MediaInfo,
   ids: {
     uploadID: string,
     messageServerID: ?string,
     messageLocalID: ?string,
   },
 ) => Promise<void>;
 
 function useIntentionalSaveMedia(): IntentionalSaveMedia {
   const dispatch = useDispatch();
   const mediaReportsEnabled = useIsReportEnabled('mediaReports');
+  const invalidTokenLogOut = useInvalidCSATLogOut();
   return React.useCallback(
     async (
       mediaInfo: MediaInfo,
       ids: {
         uploadID: string,
         messageServerID: ?string,
         messageLocalID: ?string,
       },
     ) => {
       const start = Date.now();
       const { uri: mediaURI, blobURI, holder, encryptionKey } = mediaInfo;
       const uri = mediaURI ?? blobURI ?? holder;
       invariant(uri, 'mediaInfo should have a uri or a blobURI');
 
       const steps: Array<MediaMissionStep> = [
         { step: 'save_media', uri, time: start },
       ];
 
       const { resultPromise, reportPromise } = saveMedia(
         uri,
         encryptionKey,
         'request',
       );
       const result = await resultPromise;
       const userTime = Date.now() - start;
 
       let message;
       if (result.success) {
         message = 'saved!';
+      } else if (result.reason === 'invalid_csat') {
+        void invalidTokenLogOut();
+        return;
       } else if (result.reason === 'save_unsupported') {
         const os: string = Platform.select({
           ios: 'iOS',
           android: 'Android',
           default: Platform.OS,
         });
         message = `saving media is unsupported on ${os}`;
       } else if (result.reason === 'missing_permission') {
         message = 'don’t have permission :(';
       } else if (
         result.reason === 'resolve_failed' ||
         result.reason === 'data_uri_failed'
       ) {
         message = 'failed to resolve :(';
       } else if (result.reason === 'fetch_failed') {
         message = 'failed to download :(';
       } else {
         message = 'failed to save :(';
       }
       displayActionResultModal(message);
 
       if (!mediaReportsEnabled) {
         return;
       }
       const reportSteps = await reportPromise;
       steps.push(...reportSteps);
       const totalTime = Date.now() - start;
       const mediaMission = { steps, result, userTime, totalTime };
 
       const { uploadID, messageServerID, messageLocalID } = ids;
       const uploadIDIsLocal = isLocalUploadID(uploadID);
       const report: ClientMediaMissionReportCreationRequest = {
         type: reportTypes.MEDIA_MISSION,
         time: Date.now(),
         platformDetails: getConfig().platformDetails,
         mediaMission,
         uploadServerID: uploadIDIsLocal ? undefined : uploadID,
         uploadLocalID: uploadIDIsLocal ? uploadID : undefined,
         messageServerID,
         messageLocalID,
         id: generateReportID(),
       };
       dispatch({
         type: queueReportsActionType,
         payload: { reports: [report] },
       });
     },
-    [dispatch, mediaReportsEnabled],
+    [dispatch, mediaReportsEnabled, invalidTokenLogOut],
   );
 }
 
 type Permissions = 'check' | 'request';
 
 function saveMedia(
   uri: string,
   encryptionKey?: ?string,
   permissions?: Permissions = 'check',
 ): {
   resultPromise: Promise<MediaMissionResult>,
   reportPromise: Promise<$ReadOnlyArray<MediaMissionStep>>,
 } {
   let resolveResult;
   const sendResult = (result: MediaMissionResult) => {
     if (resolveResult) {
       resolveResult(result);
     }
   };
 
   const reportPromise = innerSaveMedia(
     uri,
     encryptionKey,
     permissions,
     sendResult,
   );
   const resultPromise = new Promise<MediaMissionResult>(resolve => {
     resolveResult = resolve;
   });
 
   return { reportPromise, resultPromise };
 }
 
 async function innerSaveMedia(
   uri: string,
   encryptionKey?: ?string,
   permissions: Permissions,
   sendResult: (result: MediaMissionResult) => void,
 ): Promise<$ReadOnlyArray<MediaMissionStep>> {
   if (Platform.OS === 'android') {
     return await saveMediaAndroid(uri, encryptionKey, permissions, sendResult);
   } else if (Platform.OS === 'ios') {
     return await saveMediaIOS(uri, encryptionKey, sendResult);
   } else {
     sendResult({ success: false, reason: 'save_unsupported' });
     return [];
   }
 }
 
 const androidSavePermission =
   PermissionsAndroid.PERMISSIONS.WRITE_EXTERNAL_STORAGE;
 
 // On Android, we save the media to our own Comm folder in the
 // Pictures directory, and then trigger the media scanner to pick it up
 async function saveMediaAndroid(
   inputURI: string,
   encryptionKey?: ?string,
   permissions: Permissions,
   sendResult: (result: MediaMissionResult) => void,
 ): Promise<$ReadOnlyArray<MediaMissionStep>> {
   const steps: Array<MediaMissionStep> = [];
 
   let hasPermission = false,
     permissionCheckExceptionMessage;
   const permissionCheckStart = Date.now();
   try {
     hasPermission = await requestAndroidPermission(
       androidSavePermission,
       'throw',
     );
   } catch (e) {
     permissionCheckExceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'permissions_check',
     success: hasPermission,
     exceptionMessage: permissionCheckExceptionMessage,
     time: Date.now() - permissionCheckStart,
     platform: Platform.OS,
     permissions: [androidSavePermission],
   });
   if (!hasPermission) {
     sendResult({ success: false, reason: 'missing_permission' });
     return steps;
   }
 
   const promises = [];
   let success = true;
   const saveFolder = `${filesystem.PicturesDirectoryPath}/Comm/`;
   promises.push(
     (async () => {
       const makeDirectoryStep = await mkdir(saveFolder);
       if (!makeDirectoryStep.success) {
         success = false;
         sendResult({ success, reason: 'make_directory_failed' });
       }
       steps.push(makeDirectoryStep);
     })(),
   );
 
   let uri = inputURI;
   let tempFile, mime;
   if (uri.startsWith('http') || isBlobServiceURI(uri)) {
     promises.push(
       (async () => {
         const { result: tempSaveResult, steps: tempSaveSteps } =
           await saveRemoteMediaToDisk(
             uri,
             encryptionKey,
             temporaryDirectoryPath,
           );
         steps.push(...tempSaveSteps);
         if (!tempSaveResult.success) {
           success = false;
           sendResult(tempSaveResult);
         } else {
           tempFile = tempSaveResult.path;
           uri = `file://${tempFile}`;
           mime = tempSaveResult.mime;
         }
       })(),
     );
   }
 
   await Promise.all(promises);
   if (!success) {
     return steps;
   }
 
   const { result: copyResult, steps: copySteps } = await copyToSortedDirectory(
     uri,
     saveFolder,
     mime,
   );
   steps.push(...copySteps);
   if (!copyResult.success) {
     sendResult(copyResult);
     return steps;
   }
   sendResult({ success: true });
 
   const postResultPromises = [];
 
   postResultPromises.push(
     (async () => {
       const scanFileStep = await androidScanFile(copyResult.path);
       steps.push(scanFileStep);
     })(),
   );
 
   if (tempFile) {
     postResultPromises.push(
       (async (file: string) => {
         const disposeStep = await disposeTempFile(file);
         steps.push(disposeStep);
       })(tempFile),
     );
   }
 
   await Promise.all(postResultPromises);
   return steps;
 }
 
 // On iOS, we save the media to the camera roll
 async function saveMediaIOS(
   inputURI: string,
   encryptionKey?: ?string,
   sendResult: (result: MediaMissionResult) => void,
 ): Promise<$ReadOnlyArray<MediaMissionStep>> {
   const steps: Array<MediaMissionStep> = [];
 
   let uri = inputURI;
   let tempFile;
   if (uri.startsWith('http') || isBlobServiceURI(uri)) {
     const { result: tempSaveResult, steps: tempSaveSteps } =
       await saveRemoteMediaToDisk(uri, encryptionKey, temporaryDirectoryPath);
     steps.push(...tempSaveSteps);
     if (!tempSaveResult.success) {
       sendResult(tempSaveResult);
       return steps;
     }
     tempFile = tempSaveResult.path;
     uri = `file://${tempFile}`;
   } else if (!uri.startsWith('file://')) {
     const mediaNativeID = getMediaLibraryIdentifier(uri);
     if (mediaNativeID) {
       const { result: fetchAssetInfoResult, steps: fetchAssetInfoSteps } =
         await fetchAssetInfo(mediaNativeID);
       steps.push(...fetchAssetInfoSteps);
       const { localURI } = fetchAssetInfoResult;
       if (localURI) {
         uri = localURI;
       }
     }
   }
 
   if (!uri.startsWith('file://')) {
     sendResult({ success: false, reason: 'resolve_failed', uri });
     return steps;
   }
 
   let success = false,
     exceptionMessage;
   const start = Date.now();
   try {
     await MediaLibrary.saveToLibraryAsync(uri);
     success = true;
   } catch (e) {
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'ios_save_to_library',
     success,
     exceptionMessage,
     time: Date.now() - start,
     uri,
   });
 
   if (success) {
     sendResult({ success: true });
   } else {
     sendResult({ success: false, reason: 'save_to_library_failed', uri });
   }
 
   if (tempFile) {
     const disposeStep = await disposeTempFile(tempFile);
     steps.push(disposeStep);
   }
   return steps;
 }
 
 type IntermediateSaveResult = {
   result: { success: true, path: string, mime: string } | MediaMissionFailure,
   steps: $ReadOnlyArray<MediaMissionStep>,
 };
 
 async function saveRemoteMediaToDisk(
   inputURI: string,
   encryptionKey?: ?string,
   directory: string, // should end with a /
 ): Promise<IntermediateSaveResult> {
   const steps: Array<MediaMissionStep> = [];
   if (encryptionKey) {
     const authMetadata = await commCoreModule.getCommServicesAuthMetadata();
 
     const { steps: decryptionSteps, result: decryptionResult } =
       await fetchAndDecryptMedia(inputURI, encryptionKey, authMetadata, {
         destination: 'file',
         destinationDirectory: directory,
       });
     steps.push(...decryptionSteps);
     if (!decryptionResult.success) {
       return { result: decryptionResult, steps };
     }
     const { uri } = decryptionResult;
     const path = pathFromURI(uri);
     if (!path) {
       return {
         result: { success: false, reason: 'resolve_failed', uri },
         steps,
       };
     }
 
     const { steps: fetchFileInfoSteps, result: fetchFileInfoResult } =
       await fetchFileInfo(uri, undefined, {
         mime: true,
       });
     steps.push(...fetchFileInfoSteps);
     if (!fetchFileInfoResult.success) {
       return { result: fetchFileInfoResult, steps };
     }
     const { mime } = fetchFileInfoResult;
     if (!mime) {
       return {
         steps,
         result: {
           success: false,
           reason: 'media_type_fetch_failed',
           detectedMIME: mime,
         },
       };
     }
 
     return {
       result: { success: true, path, mime },
       steps,
     };
   }
 
   const { result: fetchBlobResult, steps: fetchBlobSteps } =
     await fetchBlob(inputURI);
   steps.push(...fetchBlobSteps);
   if (!fetchBlobResult.success) {
     return { result: fetchBlobResult, steps };
   }
   const { mime, base64 } = fetchBlobResult;
 
   const tempName = readableFilename('', mime);
   if (!tempName) {
     return {
       result: { success: false, reason: 'mime_check_failed', mime },
       steps,
     };
   }
   const tempPath = `${directory}tempsave.${tempName}`;
 
   const start = Date.now();
   let success = false,
     exceptionMessage;
   try {
     await filesystem.writeFile(tempPath, base64, 'base64');
     success = true;
   } catch (e) {
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'write_file',
     success,
     exceptionMessage,
     time: Date.now() - start,
     path: tempPath,
     length: base64.length,
   });
 
   if (!success) {
     return { result: { success: false, reason: 'write_file_failed' }, steps };
   }
   return { result: { success: true, path: tempPath, mime }, steps };
 }
 
 async function copyToSortedDirectory(
   localURI: string,
   directory: string, // should end with a /
   inputMIME: ?string,
 ): Promise<IntermediateSaveResult> {
   const steps: Array<MediaMissionStep> = [];
 
   const path = pathFromURI(localURI);
   if (!path) {
     return {
       result: { success: false, reason: 'resolve_failed', uri: localURI },
       steps,
     };
   }
   let mime = inputMIME;
 
   const hashStepPromise = fetchFileHash(path);
   const fileInfoPromise: Promise<?{
     steps: $ReadOnlyArray<MediaMissionStep>,
     result: MediaMissionFailure | FetchFileInfoResult,
   }> = (async () => {
     if (mime) {
       return undefined;
     }
     return await fetchFileInfo(localURI, undefined, {
       mime: true,
     });
   })();
   const [hashStep, fileInfoResult] = await Promise.all([
     hashStepPromise,
     fileInfoPromise,
   ]);
 
   steps.push(hashStep);
   if (!hashStep.success) {
     return {
       result: { success: false, reason: 'fetch_file_hash_failed' },
       steps,
     };
   }
   const { hash } = hashStep;
   invariant(hash, 'hash should be truthy if hashStep.success is truthy');
 
   if (fileInfoResult) {
     steps.push(...fileInfoResult.steps);
     if (fileInfoResult.result.success && fileInfoResult.result.mime) {
       ({ mime } = fileInfoResult.result);
     }
   }
   if (!mime) {
     return {
       result: { success: false, reason: 'mime_check_failed', mime },
       steps,
     };
   }
 
   const name = readableFilename(hash, mime);
   if (!name) {
     return {
       result: { success: false, reason: 'mime_check_failed', mime },
       steps,
     };
   }
   const newPath = `${directory}${name}`;
 
   const copyStep = await copyFile(path, newPath);
   steps.push(copyStep);
   if (!copyStep.success) {
     return {
       result: { success: false, reason: 'copy_file_failed' },
       steps,
     };
   }
 
   return {
     result: { success: true, path: newPath, mime },
     steps,
   };
 }
 
 export { useIntentionalSaveMedia, saveMedia };
diff --git a/web/media/encryption-utils.js b/web/media/encryption-utils.js
index 338ca731c..901db1f31 100644
--- a/web/media/encryption-utils.js
+++ b/web/media/encryption-utils.js
@@ -1,289 +1,309 @@
 // @flow
 
 import invariant from 'invariant';
 import * as React from 'react';
 import { thumbHashToDataURL } from 'thumbhash';
 
+import { useInvalidCSATLogOut } from 'lib/actions/user-actions.js';
 import * as AES from 'lib/media/aes-crypto-utils-common.js';
 import { hexToUintArray, uintArrayToHexString } from 'lib/media/data-utils.js';
 import { fileInfoFromData } from 'lib/media/file-utils.js';
 import { fetchableMediaURI } from 'lib/media/media-utils.js';
 import { IdentityClientContext } from 'lib/shared/identity-client-context.js';
 import type { AuthMetadata } from 'lib/shared/identity-client-context.js';
 import type {
   MediaMissionFailure,
   MediaMissionStep,
 } from 'lib/types/media-types.js';
 import { isBlobServiceURI } from 'lib/utils/blob-service.js';
 import { getMessageForException } from 'lib/utils/errors.js';
 import { calculatePaddedLength, pad, unpad } from 'lib/utils/pkcs7-padding.js';
-import { createDefaultHTTPRequestHeaders } from 'lib/utils/services-utils.js';
+import {
+  createDefaultHTTPRequestHeaders,
+  httpResponseIsInvalidCSAT,
+} from 'lib/utils/services-utils.js';
 
 import { base64DecodeBuffer } from '../utils/base64-utils.js';
 
 const PADDING_THRESHOLD = 5000000; // 5MB
 
 type EncryptFileResult = {
   +success: true,
   +file: File,
   +uri: string,
   +encryptionKey: string,
   +sha256Hash: string,
 };
 
 async function encryptFile(input: File): Promise<{
   steps: $ReadOnlyArray<MediaMissionStep>,
   result: EncryptFileResult | MediaMissionFailure,
 }> {
   const steps = [];
   let success = true,
     exceptionMessage;
 
   // Step 1: Read the file into an ArrayBuffer
   let data;
   const arrayBufferStart = Date.now();
   try {
     const inputBuffer = await input.arrayBuffer();
     data = new Uint8Array(inputBuffer);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'array_buffer_from_blob',
     success,
     exceptionMessage,
     time: Date.now() - arrayBufferStart,
   });
   if (!success || !data) {
     return { steps, result: { success: false, reason: 'array_buffer_failed' } };
   }
 
   // Step 2: Encrypt the data
   const startEncrypt = Date.now();
   const paddedLength = calculatePaddedLength(data.length);
   const shouldPad = paddedLength <= PADDING_THRESHOLD;
   let key, encryptedData, sha256;
   try {
     const plaintextData = shouldPad ? pad(data) : data;
     key = await AES.generateKeyCommon(crypto);
     encryptedData = await AES.encryptCommon(crypto, key, plaintextData);
 
     const hashBytes = await crypto.subtle.digest('SHA-256', encryptedData);
     sha256 = btoa(String.fromCharCode(...new Uint8Array(hashBytes)));
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'encrypt_data',
     dataSize: encryptedData?.byteLength ?? -1,
     isPadded: shouldPad,
     time: Date.now() - startEncrypt,
     sha256,
     success,
     exceptionMessage,
   });
   if (encryptedData && !sha256) {
     return { steps, result: { success: false, reason: 'digest_failed' } };
   }
   if (!success || !encryptedData || !key || !sha256) {
     return { steps, result: { success: false, reason: 'encryption_failed' } };
   }
 
   // Step 3: Create a File from the encrypted data
   const output = new File([encryptedData], input.name, { type: input.type });
   return {
     steps,
     result: {
       success: true,
       file: output,
       uri: URL.createObjectURL(output),
       encryptionKey: uintArrayToHexString(key),
       sha256Hash: sha256,
     },
   };
 }
 
 type DecryptFileStep =
   | {
       +step: 'fetch_buffer',
       +url: string,
       +time: number,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'decrypt_data',
       +dataSize: number,
       +time: number,
       +isPadded: boolean,
       +success: boolean,
       +exceptionMessage: ?string,
     }
   | {
       +step: 'save_blob',
       +objectURL: ?string,
       +mimeType: string,
       +time: number,
       +success: boolean,
       +exceptionMessage: ?string,
     };
 type DecryptionFailure =
   | MediaMissionFailure
   | {
       +success: false,
       +reason: 'decrypt_data_failed' | 'save_blob_failed',
     };
 
 type FetchAndDecryptMediaOutput = {
   steps: $ReadOnlyArray<DecryptFileStep>,
   result: { success: true, uri: string } | DecryptionFailure,
 };
 
 /**
  * Fetches the encrypted media for given {@link blobURI}, decrypts it,
  * and stores it in a blob. Returns the object URL of the blob.
  *
  * The returned object URL should be revoked when the media is no longer needed.
  */
 async function fetchAndDecryptMedia(
   blobURI: string,
   encryptionKey: string,
   authMetadata: AuthMetadata,
 ): Promise<FetchAndDecryptMediaOutput> {
   let success = true;
   let exceptionMessage;
   const steps: DecryptFileStep[] = [];
 
   // Step 1 - Fetch the encrypted media and convert it to a Uint8Array
+  const isBlobServiceHosted = isBlobServiceURI(blobURI);
+
   let headers;
-  if (isBlobServiceURI(blobURI)) {
+  if (isBlobServiceHosted) {
     headers = createDefaultHTTPRequestHeaders(authMetadata);
   }
 
   let data;
   const fetchStartTime = Date.now();
   const url = fetchableMediaURI(blobURI);
   try {
     const response = await fetch(url, { headers });
     if (!response.ok) {
+      if (isBlobServiceHosted && httpResponseIsInvalidCSAT(response)) {
+        return { steps, result: { success: false, reason: 'invalid_csat' } };
+      }
       throw new Error(`HTTP error ${response.status}: ${response.statusText}`);
     }
     const buffer = await response.arrayBuffer();
     data = new Uint8Array(buffer);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'fetch_buffer',
     url,
     time: Date.now() - fetchStartTime,
     success,
     exceptionMessage,
   });
   if (!success || !data) {
     return {
       steps,
       result: { success: false, reason: 'fetch_failed' },
     };
   }
 
   // Step 2 - Decrypt the data
   let decryptedData;
   const decryptStartTime = Date.now();
   try {
     const keyBytes = hexToUintArray(encryptionKey);
     const plaintext = await AES.decryptCommon(crypto, keyBytes, data);
     decryptedData =
       plaintext.byteLength > PADDING_THRESHOLD ? plaintext : unpad(plaintext);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'decrypt_data',
     dataSize: decryptedData?.byteLength ?? -1,
     time: Date.now() - decryptStartTime,
     isPadded: data.byteLength > PADDING_THRESHOLD,
     success,
     exceptionMessage,
   });
   if (!success || !decryptedData) {
     return { steps, result: { success: false, reason: 'decrypt_data_failed' } };
   }
 
   // Step 3 - Create a blob from the decrypted data and return it
   const saveStartTime = Date.now();
   const { mime } = fileInfoFromData(decryptedData);
   if (!mime) {
     return {
       steps,
       result: { success: false, reason: 'mime_check_failed', mime },
     };
   }
 
   let objectURL;
   try {
     invariant(mime, 'mime type should be defined');
     const decryptedBlob = new Blob([decryptedData], { type: mime });
     objectURL = URL.createObjectURL(decryptedBlob);
   } catch (e) {
     success = false;
     exceptionMessage = getMessageForException(e);
   }
   steps.push({
     step: 'save_blob',
     objectURL,
     mimeType: mime,
     time: Date.now() - saveStartTime,
     success,
     exceptionMessage,
   });
   if (!success || !objectURL) {
     return {
       steps,
       result: { success: false, reason: 'save_blob_failed' },
     };
   }
 
   return { steps, result: { success: true, uri: objectURL } };
 }
 
 function useFetchAndDecryptMedia(): (
   blobURI: string,
   encryptionKey: string,
 ) => Promise<FetchAndDecryptMediaOutput> {
   const identityContext = React.useContext(IdentityClientContext);
   invariant(identityContext, 'Identity context should be set');
   const { getAuthMetadata } = identityContext;
 
+  const invalidTokenLogOut = useInvalidCSATLogOut();
+
   return React.useCallback(
     async (blobURI, encryptionKey) => {
       const authMetadata = await getAuthMetadata();
-      return fetchAndDecryptMedia(blobURI, encryptionKey, authMetadata);
+      const output = await fetchAndDecryptMedia(
+        blobURI,
+        encryptionKey,
+        authMetadata,
+      );
+
+      if (!output.result.success && output.result.reason === 'invalid_csat') {
+        void invalidTokenLogOut();
+      }
+      return output;
     },
-    [getAuthMetadata],
+    [getAuthMetadata, invalidTokenLogOut],
   );
 }
 
 async function decryptThumbhashToDataURL(
   encryptedThumbHash: string,
   keyHex: string,
 ): Promise<string> {
   const encryptedData = base64DecodeBuffer(encryptedThumbHash);
   const thumbhashBytes = await AES.decryptCommon(
     crypto,
     hexToUintArray(keyHex),
     encryptedData,
   );
   return thumbHashToDataURL(thumbhashBytes);
 }
 
 export {
   encryptFile,
   fetchAndDecryptMedia,
   useFetchAndDecryptMedia,
   decryptThumbhashToDataURL,
 };