Success Criterion 2.2.1 Timing Adjustable

[matthewford]

Most of the examples on how to pass this criteria use javascript, does one need to have a solution that doesn't use js for pass the criteria or is a js only solution for extension ok?

In addition to this how are people balancing the security needs of systems that cannot have a long session?