2.2.5 Re-authenticating

Who it helps

People with motor, cognitive or vision disabilities often take longer to fill in forms. That makes them more likely to hit a session timeout. Re-entering everything after signing in again is slow, tiring and sometimes impossible.

How to meet it

• When a session expires on submit, keep the submitted data on the server, ask the user to sign in, then process or restore it.
• Pass the page the user was on, and a reference to the saved data, through the sign-in form.
• Where you can, show the sign-in form in a dialog on the same page, so the form and its values stay in place.
• Save drafts of long forms as the user goes, so an expired session never wipes them.
• Level AAA is not required by most laws or policies, which point to AA. It is still worth meeting where you can.

Examples

<form action="/login" method="post">
  <label for="email">Email</label>
  <input id="email" name="email" type="email" autocomplete="email">
  <label for="password">Password</label>
  <input id="password" name="password" type="password" autocomplete="current-password">
  <button type="submit">Sign in</button>
</form>

<form action="/login" method="post">
  <input type="hidden" name="return_to" value="/apply/step-3">
  <input type="hidden" name="draft_id" value="d_8f2c1">
  <label for="email">Email</label>
  <input id="email" name="email" type="email" autocomplete="email">
  <label for="password">Password</label>
  <input id="password" name="password" type="password" autocomplete="current-password">
  <button type="submit">Sign in and continue</button>
</form>

Common mistakes

• Redirecting to a generic sign-in page that drops the original request and form data.
• Restoring the page after sign-in but with every field empty.
• Saving drafts only in the browser tab, so they vanish when the sign-in flow reloads the page.
• Losing the user's place in a multi-step process and sending them back to step one.

Related criteria

• 2.2.1 Timing Adjustable
• 2.2.6 Timeouts
• 3.3.7 Redundant Entry

Official W3C explanation of 2.2.5