Skip to content

Commit f45b557

Browse files
patrickhlaukedbjorgekfranqueirombgower
authored
Add security mention to Timing Adjustable and tweak Re-Authentication (#4382)
* adds mention of security exceptions such as two-factor/MFA tokens (under "essential") for timing adjustable * tweaks examples in re-authentication (they appear to violate timing adjustable at the moment) and cross-reference to timing adjustable bonus: * removes excessive whitespace (spaces, tabs, empty lines) from the two understanding docs * replaces a `<p><strong>...</strong></p>` with actual heading markup * replaces "spasticity" - while medically accurate, this ... just looks off * removes the "quiz" example from re-authenticating understanding, as it was debatable if expecting the user to manually save (rather than automatically saving) actually satisfies the SC closes #1424 closes #3290 Diff previews for Understanding [Timing Adjustable](https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FWAI%2FWCAG22%2FUnderstanding%2Ftiming-adjustable&doc2=https%3A%2F%2Fdeploy-preview-4382--wcag2.netlify.app%2Funderstanding%2Ftiming-adjustable) and [Re-Authentication](https://services.w3.org/htmldiff?doc1=https://www.w3.org/WAI/WCAG22/Understanding/re-authenticating.html&doc2=https://deploy-preview-4382--wcag2.netlify.app/understanding/re-authenticating) --------- Co-authored-by: Dan Bjorge <[email protected]> Co-authored-by: Kenneth G. Franqueiro <[email protected]> Co-authored-by: Mike Gower <[email protected]>
1 parent 87842eb commit f45b557

File tree

2 files changed

+54
-105
lines changed

2 files changed

+54
-105
lines changed

‎understanding/20/re-authenticating.html‎

Lines changed: 20 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -7,73 +7,68 @@
77
</head>
88
<body>
99
<h1>Understanding Re-authenticating</h1>
10-
10+
1111
<section id="brief">
1212
<h2>In brief</h2>
1313
<dl>
1414
<dt>Goal</dt><dd>Users do not lose information or context due to reauthentication.</dd>
1515
<dt>What to do</dt><dd>Preserve users' prior activity and data through reauthentication.</dd>
16-
<dt>Why it's important</dt><dd>Some people may require additional time to complete an activity.</dd>
16+
<dt>Why it's important</dt><dd>Some people may require additional time to complete an activity.</dd>
1717
</dl>
1818

1919
</section>
20-
20+
2121
<section id="intent">
2222
<h2>Intent of Re-authenticating</h2>
23-
24-
23+
2524
<p>The intent of this success criterion is to allow all users to complete authenticated
2625
transactions that have inactivity time limits or other circumstances that would cause
2726
a user to be logged out while in the midst of completing the transaction.
2827
</p>
29-
3028
<p>For security reasons, many sites implement an authentication time limit after a certain
3129
period of inactivity. These time limits may cause problems for persons with disabilities
32-
because it may take longer for them to complete the activity.
30+
because it may take longer for them to complete the activity.
3331
</p>
34-
3532
<p>Other sites will log a person out of a session if a person logs in on the website
3633
from another computer or if other activities arise that make the site suspicious of
3734
whether the person is still the same legitimate person who logged in originally. When
3835
users are logged out while still in the midst of a transaction - it is important that
3936
they be given the ability to re-authenticate and continue with the transaction without
4037
the loss of any data already entered.
41-
4238
</p>
43-
44-
39+
<p class="note">Sites that implement session time limits and re-authentication requests are
40+
still subject to the requirements of other criteria, such as
41+
<a href="timing-adjustable">2.2.1 Timing Adjustable</a>.
42+
</p>
4543
</section>
44+
4645
<section id="benefits">
4746
<h2>Benefits of Re-authenticating</h2>
48-
49-
47+
5048
<ul>
51-
5249
<li>This success criterion benefits people who may require additional time to complete
5350
an activity. People with cognitive limitations may read slowly and require additional
5451
time to read and respond to a questionnaire. Users interacting via a screen reader
55-
may need extra time to navigate and complete a complicated form.
52+
may need extra time to navigate and complete a complicated form.
5653
A person with motor impairments or who navigates with an alternative input device
5754
may require additional time to navigate through or complete input within a form.
5855
</li>
59-
6056
<li>In circumstances where a sign-language interpreter may be relating audio content to
6157
a user who is deaf, control over time limits is also important.
6258
</li>
63-
6459
</ul>
65-
6660
</section>
67-
61+
6862
<section id="examples">
6963
<h2>Examples of Re-authenticating</h2>
70-
64+
7165
<dl>
7266
<dt>A shopping site checkout</dt>
73-
<dd>A user with extremely limited use of the hands is logged into a shopping site. It
74-
takes so long to enter credit card information into the application that a time limit
75-
occurs while the user is performing the checkout process. When the user returns to
76-
the checkout process and submits the form, the site returns a login screen to re-authenticate.
67+
<dd>A user is logged into a shopping site. While in the middle of the checkout process, the user
68+
is interrupted and has to leave their computer. While they are away, the site prompts the user
69+
that the process is about to time out, and offers the ability to extend the timeout – but with
70+
the user away, the timeout is not extended and the user is logged out. When the user returns to
71+
the computer, they have to re-authenticate.
7772
After the user logs in, the check out process is restored with the same information
7873
and at the same stage. The user did not lose any data because the server had temporarily
7974
accepted and stored the submission even though the session had timed out and restored
@@ -83,22 +78,11 @@ <h2>Examples of Re-authenticating</h2>
8378
the user several minutes before the time-out occurs and provides a link to open a
8479
new window in order to re-authenticate. The original window with the in-progress email
8580
remains intact and, after re-authentication, the user may send that data.</dd>
86-
<dt>A questionnaire with a time limit</dt>
87-
<dd>A long questionnaire provided within a single web page has information at the beginning
88-
that indicates that the session will time out after 15 minutes. The user is also informed
89-
that the questionnaire can be saved at any point and completed at a later time. Within
90-
the web page there are several buttons provided to save the partially completed form.
91-
In addition, with JavaScript in the list of accessibility-supported content technologies
92-
that are relied upon, the user can elect to be alerted via a pop-up if the session
93-
is close to timing out.</dd>
9481
</dl>
95-
9682
</section>
97-
83+
9884
<section id="resources">
9985
<h2>Resources for Re-authenticating</h2>
100-
101-
10286
</section>
10387

10488
{% # Data for associated techniques is defined in understanding/understanding.11tydata.js %}

‎understanding/20/timing-adjustable.html‎

Lines changed: 34 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
</head>
88
<body>
99
<h1>Understanding Timing Adjustable</h1>
10-
10+
1111
<section id="brief">
1212
<h2>In brief</h2>
1313
<dl>
@@ -17,11 +17,10 @@ <h2>In brief</h2>
1717
</dl>
1818

1919
</section>
20-
20+
2121
<section id="intent">
2222
<h2>Intent of Timing Adjustable</h2>
23-
24-
23+
2524
<p>The intent of this success criterion is to ensure that users with disabilities are
2625
given adequate time to interact with web content whenever possible. People with disabilities
2726
such as blindness, low vision, dexterity impairments, and cognitive limitations may
@@ -34,59 +33,55 @@ <h2>Intent of Timing Adjustable</h2>
3433
limit occurs helps those users who require more time than expected to successfully
3534
complete tasks. These options are listed in the order that will be most helpful for
3635
the user. Disabling time limits is better than customizing the length of time limits,
37-
which is better than requesting more time before a time limit occurs.
36+
which is better than requesting more time before a time limit occurs.
3837
</p>
39-
38+
4039
<p>Any process that happens without user initiation after a set time or on a periodic
4140
basis is a time limit. This includes partial or full updates of content (for example,
4241
page refresh), changes to content, or the expiration of a window of opportunity for
43-
a user to react to a request for input.
42+
a user to react to a request for input.
4443
</p>
45-
44+
4645
<p>It also includes content that is advancing or updating at a rate beyond the user's ability to read and/or understand it. In other words, animated, moving or scrolling content introduces a time limit on a users ability to read content.</p>
4746

4847
<p>This success criterion is generally not applicable when the content repeats or is synchronized with other content, so long as the information and data is adjustable or otherwise under the control of the end user. Examples of time limits for which this success criterion is not applicable include scrolling text that repeats, captioning, and <a href="https://www.w3.org/WAI/tutorials/carousels/">carousels</a>. These are situations which do include time limits, but the content is still available to the user because it has controls for accessing it, as specified in <a href="../../guidelines/sc/20/pause-stop-hide.html">2.2.2 Pause, Stop, Hide</a>.</p>
4948

5049
<p>In some cases, however, it is not possible to change the time limit (for example, for an auction or other real-time event) and exceptions are therefore provided for those cases.</p>
51-
50+
5251
<p>Content that operates on a timer does not need to be time adjustable if there is an alternative that does not rely on a timer. For example, a web application such as an email client provides notification of new email arriving with a temporary message (such as a 'toast' message) in the lower right-hand side of the interface, and the message disappears after 5 seconds. Users are able to identify the arrival of email through other means, such as viewing the Inbox, so the disappearance of the message does not set a time limit on the their ability to determine if new mail has arrived. If the user has no other means of discovering the same information (or performing the same function), then each message would need to meet this success criterion in order to provide users with sufficient time to access the information.</p>
5352

54-
<p>
55-
56-
<strong>Notes regarding server time limits</strong>
57-
58-
</p>
59-
53+
<h3>Notes regarding time limits</h3>
54+
6055
<ul>
61-
6256
<li>Timed server redirects can be found below under Common Failures.</li>
63-
6457
<li>Non-timed server redirects (e.g., 3xx response codes) are not applicable because there
6558
is no time limit: they work instantly.
6659
</li>
67-
6860
<li>This success criterion applies only to time limits that are set by the content itself.
6961
For example, if a time limit is included in order to address security concerns, it
7062
would be considered to have been set by the content because it is designed to be
7163
part of the presentation and interaction experience for that content. Time limits
7264
set externally to content, such as by the user agent or by factors intrinsic to the
7365
Internet are not under the author's control and not subject to WCAG conformance requirements.
7466
Time limits set by web servers should be under the author's/organization's control
75-
and are covered. (Success Criteria
76-
<a href="no-timing" class="guideline">2.2.3</a>,
77-
<a href="interruptions" class="guideline">2.2.4</a> and
78-
<a href="re-authenticating" class="guideline">2.2.5</a> may also apply.)
67+
and are covered. Success Criteria
68+
<a href="no-timing" class="guideline">2.2.3 No Timing</a>,
69+
<a href="interruptions" class="guideline">2.2.4 Interruptions</a>, and
70+
<a href="re-authenticating" class="guideline">2.2.5 Re-Authentication</a> may also apply.
7971
</li>
80-
72+
<li>Certain time limits implemented for security reasons, such as time-based / time-limited
73+
two-factor authentication tokens, can be considered <em>essential</em>, and may be
74+
exempt from this criterion. However, other criteria may apply, such as
75+
<a href="redundant-entry">3.3.7 Redundant Entry</a>,
76+
<a href="accessible-authentication-minimum">3.3.8 Accessible Authentication (Minimum)</a>, and
77+
<a href="accessible-authentication-enhanced">3.3.9 Accessible Authentication (Enhanced)</a> may also apply.</li>
8178
<li>Ten times the default was chosen based on clinical experience and other guidelines.
8279
For example, if 15 seconds is allowed for a user to respond and hit a switch, 150
8380
seconds would be sufficient to allow almost all users to hit a switch even if they
8481
had trouble.
85-
8682
</li>
87-
8883
<li>20 seconds was also based on clinical experience and other guidelines. 20 seconds
89-
to hit 'any switch' is sufficient for almost all users including those with spasticity.
84+
to hit 'any switch' is sufficient for almost all users including those with reduced motion.
9085
Some would fail, but some would fail all lengths of time. A reasonable period for
9186
requesting more time is required since an arbitrarily long time can provide security
9287
risks to all users, including those with disabilities, for some applications. For
@@ -100,33 +95,21 @@ <h2>Intent of Timing Adjustable</h2>
10095
key," 20 seconds would meet this. If the person indicates that they are still present,
10196
the device should return the user to the exact condition that existed before it asked
10297
the question.
103-
104-
</li>
105-
106-
<li>20 hours was chosen as an upper limit because it is longer than a full waking day.
107-
10898
</li>
109-
99+
<li>20 hours was chosen as an upper limit because it is longer than a full waking day.</li>
110100
</ul>
111-
101+
112102
<p>In cases where timing is not an intrinsic requirement but giving users control over
113103
timed events would invalidate the outcome, a third party can control the time limits
114-
for the user (for example, granting double time on a test).
115-
116-
</p>
117-
118-
<p>See also
119-
<a href="no-timing">2.2.3: No Timing</a>.
120-
</p>
121-
122-
104+
for the user (for example, granting double time on a test).</p>
105+
106+
<p>See also <a href="no-timing">2.2.3: No Timing</a>.</p>
107+
123108
</section>
124109
<section id="benefits">
125110
<h2>Benefits of Timing Adjustable</h2>
126-
127-
111+
128112
<ul>
129-
130113
<li>People with physical disabilities often need more time to react, to type and to complete
131114
activities. People with low vision need more time to locate things on screen and
132115
to read. People who are blind and using screen readers may need more time to understand
@@ -135,77 +118,59 @@ <h2>Benefits of Timing Adjustable</h2>
135118
deaf and communicate in sign language may need more time to read information printed
136119
in text (which may be a second language for some).
137120
</li>
138-
139121
<li>In circumstances where a sign-language interpreter may be relating audio content to
140122
a user who is deaf, control over time limits is also important.
141123
</li>
142-
143124
<li>People with reading disabilities, cognitive limitations, and learning disabilities
144125
who may need more time to read or comprehend information can have additional time
145126
to read the information by pausing the content.
146127
</li>
147-
148128
</ul>
149-
150129
</section>
151-
130+
152131
<section id="examples">
153132
<h2>Examples of Timing Adjustable</h2>
154-
155-
133+
156134
<ul>
157-
158135
<li>A website uses a client side time limit to help protect users who may step away from
159136
their computer. After a period of inactivity the web page asks if the user needs
160-
more time. If it doesn't get a response – it times out.
137+
more time. If it doesn't get a response – it times out.
161138
</li>
162-
163139
<li>A web page has a field that automatically updates with the latest headlines in a rotating
164140
fashion. There is an interactive control that allows the user to extend the length
165141
of time between each update to as much as ten times the default. The control can be
166-
operated with either a mouse or a keyboard.
167-
142+
operated with either a mouse or a keyboard.
168143
</li>
169-
170144
<li>A web page includes an animation which includes text that appears and disappears throughout.
171145
In some cases, the text is scrolling across the screen and in others, it is only displayed
172146
for a short time before it fades into the background. The page includes a pause button
173147
so that users who have trouble reading the text before it disappears can read it.
174148
</li>
175-
176149
<li>In an auction, there is a time limit on the amount of time a user has to submit a
177150
bid. Since the time limit applies to all users who want to bid on a particular item,
178151
it would be unfair to extend the time limit for any one particular user. Therefore,
179152
a time limit is required for this type of activity and no extension, adjustment, or
180153
deactivation of the time limit is required by this success criterion.
181-
182154
</li>
183-
184155
<li>An on-line ticket-purchasing site gives the user two minutes to confirm a purchase
185156
before the seats are returned to the general pool. Because tickets on such sites can
186157
sell out quickly, holding a ticket longer than that may invalidate the nature of the
187158
site, so this is a case in which the timing is essential and cannot be extended without
188159
invalidating the activity. However, the site does move as much of the process out
189160
of the time-critical period as possible, for instance allowing users to provide necessary
190161
information like name, payment method, etc., before entering the time-critical stage.
191-
192162
</li>
193-
194163
<li>A ticket-purchasing site allows the user two minutes to confirm purchase of selected
195164
seats, but warns the user when their time is almost out and allows the user to extend
196165
this time limit some number of times with a simple action such as clicking a "Extend
197166
time limit" button.
198-
199167
</li>
200-
201168
</ul>
202-
169+
203170
</section>
204-
171+
205172
<section id="resources">
206173
<h2>Resources for Timing Adjustable</h2>
207-
208-
209174
</section>
210175

211176
{% # Data for associated techniques is defined in understanding/understanding.11tydata.js %}

0 commit comments

Comments
 (0)