Skip to content

Add security mention to Timing Adjustable and tweak Re-Authentication #4382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open

Add security mention to Timing Adjustable and tweak Re-Authentication #4382

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
88708ef
Replace strong paragraph with actual heading markup
patrickhlauke May 5, 2025
e03f966
Remove excessive whitespace
patrickhlauke May 5, 2025
21d23f0
Add SC names to links
patrickhlauke May 5, 2025
cd523ad
Replace "spasticity"
patrickhlauke May 5, 2025
b0d9429
No need for parentheses
patrickhlauke May 5, 2025
7ef6fe4
The notes aren't just about "server" time limits - generalise heading
patrickhlauke May 5, 2025
e7def26
Add note about exemption for security
patrickhlauke May 5, 2025
11a06e7
Remove excessive whitespace
patrickhlauke May 5, 2025
ef0b25e
Modify reauthentication examples
patrickhlauke May 5, 2025
3db7701
Add note/cross reference from re-authentication to timing adjustable
patrickhlauke May 5, 2025
452056d
Update understanding/20/timing-adjustable.html
patrickhlauke May 5, 2025
a3f81b8
Merge branch 'main' into patrickhlauke-issue1424
patrickhlauke Jun 5, 2025
c023fa2
Merge branch 'main' into patrickhlauke-issue1424
patrickhlauke Jun 27, 2025
35e9b3b
Update understanding/20/re-authenticating.html
patrickhlauke Jun 27, 2025
fa9f2b7
Update understanding/20/re-authenticating.html
patrickhlauke Jun 27, 2025
01695c3
Update understanding/20/re-authenticating.html
patrickhlauke Jun 27, 2025
a3148a5
Update understanding/20/timing-adjustable.html
patrickhlauke Jun 27, 2025
9f679d0
Update understanding/20/timing-adjustable.html
patrickhlauke Jun 27, 2025
38322bb
Update understanding/20/timing-adjustable.html
patrickhlauke Jun 27, 2025
1737264
Merge branch 'main' into patrickhlauke-issue1424
patrickhlauke Aug 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 31 additions & 69 deletions understanding/20/re-authenticating.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,79 +1,74 @@
<!DOCTYPE html>
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="UTF-8"></meta>
<meta charset="UTF-8"/>
<title>Understanding Re-authenticating</title>
<link rel="stylesheet" type="text/css" href="../../css/sources.css" class="remove"/>
</head>
<body>
<h1>Understanding Re-authenticating</h1>

<section id="brief">
<h2>In brief</h2>
<dl>
<dt>Goal</dt><dd>Users do not lose information or context due to reauthentication.</dd>
<dt>What to do</dt><dd>Preserve users' prior activity and data through reauthentication.</dd>
<dt>Why it's important</dt><dd>Some people may require additional time to complete an activity.</dd>
<dt>Why it's important</dt><dd>Some people may require additional time to complete an activity.</dd>
</dl>

</section>

<section id="intent">
<h2>Intent of Re-authenticating</h2>



<p>The intent of this success criterion is to allow all users to complete authenticated
transactions that have inactivity time limits or other circumstances that would cause
a user to be logged out while in the midst of completing the transaction.
</p>

<p>For security reasons, many sites implement an authentication time limit after a certain
period of inactivity. These time limits may cause problems for persons with disabilities
because it may take longer for them to complete the activity.
because it may take longer for them to complete the activity.
</p>

<p>Other sites will log a person out of a session if a person logs in on the website
from another computer or if other activities arise that make the site suspicious of
whether the person is still the same legitimate person who logged in originally. When
users are logged out while still in the midst of a transaction - it is important that
they be given the ability to re-authenticate and continue with the transaction without
the loss of any data already entered.

</p>


<p class="note">Sites that implement session time limits and re-authentication requests are
still subject to the requirements of other criteria, such as
<a href="timing-adjustable">2.2.1 Timing Adjustable</a>.
</p>
</section>

<section id="benefits">
<h2>Benefits of Re-authenticating</h2>



<ul>

<li>This success criterion benefits people who may require additional time to complete
an activity. People with cognitive limitations may read slowly and require additional
time to read and respond to a questionnaire. Users interacting via a screen reader
may need extra time to navigate and complete a complicated form.
may need extra time to navigate and complete a complicated form.
A person with motor impairments or who navigates with an alternative input device
may require additional time to navigate through or complete input within a form.
</li>

<li>In circumstances where a sign-language interpreter may be relating audio content to
a user who is deaf, control over time limits is also important.
</li>

</ul>

</section>

<section id="examples">
<h2>Examples of Re-authenticating</h2>

<dl>
<dt>A shopping site checkout</dt>
<dd>A user with extremely limited use of the hands is logged into a shopping site. It
takes so long to enter credit card information into the application that a time limit
occurs while the user is performing the checkout process. When the user returns to
the checkout process and submits the form, the site returns a login screen to re-authenticate.
<dd>A user is logged into a shopping site. While in the middle of the checkout process, the user
is interrupted and has to leave their computer. While they are away, the site prompts the user
that the process is about to time out, and offers the ability to extend the timeout – but with
the user away, the timeout is not extended and the user is logged out. When the user returns to
the computer, they have to re-authenticate.
After the user logs in, the check out process is restored with the same information
and at the same stage. The user did not lose any data because the server had temporarily
accepted and stored the submission even though the session had timed out and restored
Expand All @@ -85,94 +80,61 @@ <h2>Examples of Re-authenticating</h2>
remains intact and, after re-authentication, the user may send that data.</dd>
<dt>A questionnaire with a time limit</dt>
<dd>A long questionnaire provided within a single web page has information at the beginning
that indicates that the session will time out after 15 minutes. The user is also informed
that indicates that the session will time out after 20 hours. The user is also informed
Copy link
Contributor

@mbgower mbgower May 26, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like there was a possible intention in the original that although this timed out after 15 minutes, the javascript function at the end of this long list of features was intended to allow it to pass due to the "adjust" method (although as written it doesn't).
My feeling is that we've got a LOT of detritus now, when the only thing the author needs to do is set it to time out after 20 hours. The rest is superfluous and risks confusing what is required.
Does it make any sense to trim it down?

Copy link
Contributor

@mbgower mbgower May 26, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In fact, there isn't even a requirement to inform the user of the time out, so just the first sentence without the next 2 would exceed what is necessary.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note to self: need to revisit why I made this change...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mbgower right, I remember now ... I chose to change this to 20 hours to align it unequivocally with the timing adjustable SC, as this is about the re-authentication SC ... so wanted to focus the thing on the reauthentication aspect, without creating weird doubts about "wouldn't this pass re-authentication but then still fail the timing SC?"

that the questionnaire can be saved at any point and completed at a later time. Within
the web page there are several buttons provided to save the partially completed form.
In addition, with JavaScript in the list of accessibility-supported content technologies
that are relied upon, the user can elect to be alerted via a pop-up if the session
is close to timing out.</dd>
</dl>

</section>

<section id="resources">
<h2>Resources for Re-authenticating</h2>


</section>

<section id="techniques">
<h2>Techniques for Re-authenticating</h2>



<section id="sufficient">
<h3>Sufficient Techniques for Re-authenticating</h3>



<ul>

<li>

<p>
Providing options to continue without loss of data using one of the following techniques:
</p>

<p>Providing options to continue without loss of data using one of the following techniques:</p>
<ul>

<li>

<a href="../Techniques/general/G105" class="general">Saving data so that it can be used after a user re-authenticates</a>

</li>

<li>

<a href="../Techniques/general/G181" class="general">Encoding user data as hidden data in re-authorization page</a>

</li>

</ul>

</li>

</ul>

<div class="note">

<p>Refer to
<p>Refer to
<a href="timing-adjustable#techniques" class="understanding">Techniques for Addressing Success Criterion 2.2.1</a> for techniques related to providing notifications about time limits.

</p>

</div>

</section>

<section id="advisory">
<h3>Additional Techniques (Advisory) for Re-authenticating</h3>


</section>

<section id="failure">
<h3>Failures for Re-authenticating</h3>



<ul>

<li>

<a href="../Techniques/failures/F12" class="failure">Failure due to having a session time limit without a mechanism for saving user's input
and re-establishing that information upon re-authentication
</a>

</li>

</ul>

</section>

</section>

</body>
</html>
Loading