Level AAAOperable
2.2.5

Re-authenticating

If a session expires, let people log back in and continue without losing the data they'd already entered.

In plain English

Sessions expire. When someone gets logged out mid-task and signs back in, this AAA rule says they should land right back where they were, with their data intact, no lost cart, no re-typing the whole checkout form.

People who move slowly or get interrupted are the ones most likely to time out, so they are the ones a “you have to start over” flow punishes hardest.

Who this is for

  • People who work slowly or get interrupted, most likely to hit a timeout.
  • Everyone, who resents re-entering a full form after a surprise logout.

How to check and fix it yourself

Start a checkout or a long form, let the session expire (or force a logout), log back in, and see whether your data survived.

Session expires mid-checkout → log in → cart + entered details restored.  ✓
Log back in → cart empty, form blank, start over.                         ✗

Where we can help

We test what happens to a cart and an in-progress form across a session timeout and re-login, and flag where data is silently lost. It pairs with the other enough-time and data-loss checks.

How to meet it

Techniques the W3C accepts as sufficient (summarized). Follow a link for the full method.

Frequently asked questions

What does re-authenticating require?+

Success Criterion 2.2.5 (Level AAA) says when a session expires and the user logs back in, they must be able to continue the activity without losing any data they had already entered.

Why does this matter?+

People who work slowly, get interrupted, or use assistive tech are more likely to hit a session timeout mid-task. If logging back in wipes their cart or a long form, they may have to start over, or give up. Preserving the data removes that penalty.

How do stores usually handle it?+

Persist the cart and any in-progress form data server-side or in the browser, tied to the account or a saved draft, so that after re-login the customer lands back where they were with everything intact.

Reference

This is a plain-language explainer. The authoritative source is the W3C Web Content Accessibility Guidelines (WCAG) 2.2.

WCAG 2.2 © W3C. Excerpts are paraphrased; see the linked documents for the normative text.

Not sure if your store passes 2.2.5?

A human auditor checks this and every other criterion against your live store, and documents the result.

Book an audit