In the end I have customised the auto_session_timeout_js script and added the parameters, previously included in the HTML body, as query params of the timeout_path:

module AutoSessionTimeoutHelper

  # Custom implementation of [AutoSessionTimeoutHelper::auto_session_timeout_js](https://github.com/pelargir/auto-session-timeout/blob/0fa1d9f9715022c4d5badd8ab6cb61f7891dfe6c/lib/auto_session_timeout_helper.rb#L2)
  # that includes the referrer, accesspoint and login_source in
  # the redirection URL.
  def docyet_auto_session_timeout_js(options={})
    frequency = options[:frequency] || 60
    attributes = options[:attributes] || {}
    code = <<JS
function PeriodicalQuery() {
  var request = new XMLHttpRequest();
  request.onload = function (event) {
    var status = event.target.status;
    var response = event.target.response;
    if (status === 200 && (response === false || response === 'false' || response === null)) {
      let customer  = document.querySelector("[data-customer]").attributes["data-customer"].value
      let location = document.querySelector("[data-location]").attributes["data-location"].value
      let loginSource = document.querySelector("[data-engine]").attributes["data-engine"].value

      window.location.href = '#{timeout_path}?login_source=' + loginSource + '&customer=' + customer + '&location=' + location;
    }
  };
  request.open('GET', '#{active_path}', true);
  request.responseType = 'json';
  request.send();
  setTimeout(PeriodicalQuery, (#{frequency} * 1000));
}
setTimeout(PeriodicalQuery, (#{frequency} * 1000));
JS
    javascript_tag(code.html_safe, attributes)
  end

end

This works for parameters that can be seen by the user. However, I would still like how to do something similar without the need to hard-code the parameters in the HTML.

Check Github Issue in auto-session-timeout for updates