Do I need to extend the session period?

No. The session may expire; the submissions must remain. Saving designs is the usual way.

Does this apply without registration?

The criterion refers to authenticated sessions. For forms without an account, caching in the browser is a good practice, but not required.

What is the difference to 2.2.6 (announce time limit)?

2.2.6 requires that visitors be warned before the deadline. 2.2.5 requires that the time limit does not destroy any work. Both together make deadlines acceptable.

This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung

Accessibility

What happens to entries when the session expires?

A long request, the session expires, after the new registration everything is gone: For people who need several times the time for the same page, this is the most common reason to give up a process. Level AAA Criterion 2.2.5 requires input to survive an expired session: After the new application, it continues at the same point.

What the Criterion Requires

If a registered session expires, the visitor can log in again and continue the process with all previous entries. How this succeeds is left to the technology: save intermediate readings on the server side, keep inputs in the browser and reload them after logging in, or quietly extend the session as long as the visitor typed. Prohibited is only the result of losing work.

Interaction with security and data protection

Meetings are held for good reason: An open account on a foreign computer is a risk. The criterion does not require holding sessions forever, but preserving input. It has proven one draft per operation, which is saved when leaving each field and offered after the new registration. Person-related incidents shall require a deadline for deletion; seven days is a common value that is in the privacy policy.

This is how we deal with it

Whether inputs survive an expired session only becomes apparent when a session expires; A measurement of the source code does not see this. An inspector tests the case on a process that the operator designates. The criterion belongs to the category AAA in knowledge.

Examples

After the new registration, everything is gone

Not met

// Sitzung abgelaufen → /login → /antrag (leer)

Passes

// Sitzung abgelaufen → /login?zurueck=/antrag/schritt-3
// Server: Entwurf je Konto und Vorgang, gespeichert beim Verlassen jedes Feldes
// Nach der Anmeldung: „Entwurf vom 13. September fortsetzen?“

The session may expire; the submissions must remain.

Save form entries as a draft when leaving each field, tied to the account.
Offer the draft after the new application: You have an application started on September 12. To continue
After signing up, return to the page where the session expired.
Delete drafts after a fixed deadline and mention the deadline in the form.

Deutsche Fassung dieser Seite