Do not let session timeouts destroy user input
F12 is a documented failure, so it names a defect rather than a route to conformance. Its subject is narrower than the warn-and-extend advice usually attached to it. F12 is about what happens afterward. A logged-in user fills in a long form, the session times out, they authenticate again, and the data is gone. Sometimes they land on a welcome page and the submission is never processed at all. Sometimes they land back on the form with every field empty, which is the version most sites produce. The argument underneath it is the one worth carrying. Somebody who needed longer than the limit allowed will need longer again on the second attempt, and again on the third, so a form that discards input on timeout is a form they can never finish. The scope is sites that require a login and end the session after a period of inactivity. A public form with no login is outside it.
How we find it in an audit
Reviewers fill in a real form, let the session expire on purpose, and then submit. Authenticate again when asked, and see what comes back. Two answers pass and one fails. The function completes using what was already entered, or the form returns with the fields still populated. An empty form is the finding, and so is a welcome page that quietly drops the submission. None of this is automatable, because it takes a session, a timeout, and somebody willing to wait for both.
How affected users experience it
The people most likely to hit a timeout are the people least able to absorb losing the work. Reading a form through a screen reader takes longer. Typing with a switch device takes longer. Understanding a benefits application with a cognitive disability takes longer, and it is the same application that has the shortest patience. Getting to the end and finding an empty form is not an inconvenience. It is the same forty minutes again, against the same clock, heading for the same ending.
Passes vs. fails
Passes
saveDraft(sessionId, form.values);
// Stored server-side on every change, and read back after re-authentication,
// so the user carries on from where the clock cut them off.Fails
// The session ends after 20 minutes of inactivity.
// Re-authentication returns the form with every field empty.The other techniques filed under this rule
3 guides on this site are filed under 2.2.5 Re-authenticating. W3C documents this one as a failure of that rule, so it describes a way the rule gets broken rather than a way to pass it.
This guide is our interpretation of W3C technique F12: Failure of Success Criterion 2.2.5 due to having a session time limit without a mechanism … re-authentication. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.