I'm just adding to Rob and MMM's answer but I agree it may benefit users more to have the second option you mentioned—an overlay message before redirecting.
Though, it depends on what your web application deals with. If it deals with a lot of security, data filling and/or anything complex, having a warning or a countdown allows the users to be notified ahead of time in case they were in the middle of something on that page, otherwise they can lose whatever they were working on.
From my personal encounters with bank sessions, timed tests, etc., I'm usually prompted like so.
I appreciate this extra step more than coming back with a notification that I instantly got logged off and can't rescind it. So perhaps with your web application, I'd go with something similar—having a huge countdown also helps.
(Source: Hannah Chen via dribbble)
Here are other questions I've encountered that help and provide me with good insight. Hopefully they'll be of some use for you as well.
Best Practices for Warning of Session Expiration
What are the best practices for implementing a session timeout/expiry in a website, being security as the main concern?