Save user data across session re-authentication
An authenticated session that times out mid-task normally throws away everything the user had typed. G105 closes that hole. The server holds the entered data in a temporary cache while the user logs back in, then hands it back so the form processes as though the timeout never happened. The cache does not have to live forever. W3C says long enough to get one user through one session, such as a day. This is a sufficient technique for 2.2.5 Re-authenticating, a Level AAA rule, and W3C narrows it further, counting it only where it genuinely lets people continue without losing data. It applies to pages that require a login and put a clock on submitting, so a public form with no session behind it is out of scope.
How we find it in an audit
There is no scan for this. A reviewer has to let a real session die and see what survives. Ours fill a form partway, force or wait out the timeout, log back in, and compare every field against what was typed. Focus position gets checked too, because landing back at the top of a restored twelve-page application is its own kind of loss.
How affected users experience it
Screen reader users, people typing with a switch device or one hand, and people who need thinking time all take longer on a form than the average the timeout was set against. So they meet that timeout far more often than the people who chose it ever did. Losing a half-finished benefits application to a login screen means starting the whole thing again. Starting again is where most people stop.
Passes vs. fails
Passes
The server keeps the half-finished application, so after re-authenticating every field holds exactly what the user typed and focus returns to the question they were on.
Fails
A benefits application logs the user out after 15 minutes, and logging back in returns them to an empty form.
Other ways to satisfy this rule
3 guides on this site are filed under 2.2.5 Re-authenticating. W3C lists this one as sufficient for that rule when used for providing options to continue without loss of data, so the condition is part of the test rather than a footnote to it.
This guide is our interpretation of W3C technique G105: Saving data so that it can be used after a user re-authenticates. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.