A Session Timeout Audit Weighs the Clock Against the Careful User

What We Keep Finding

Session policies are written for security and experienced as a race. A screen reader user filling a long form works at the speed of speech. A user with a motor disability works at the speed of their hands. The timeout does not care, fires mid-entry, and the work is gone.

The Level A rule here asks for less than people fear, and it is specific enough to check before you order. You satisfy it by letting the user turn the limit off, or adjust it, or extend it. The extend route is the one most products need, and it has two numbers in it. The user gets warned before time runs out, gets at least 20 seconds to extend with something as simple as pressing the space bar, and can do that at least ten times. Ten. Not once, which is what most implementations offer.

Now the part that gets sold wrongly everywhere, and we would rather lose the argument in advance than in your report. That rule has exactly three exceptions. The limit is part of a real-time event, or extending it would invalidate the activity itself, or it is longer than twenty hours. Security is not one of them. A timeout your bank or your card processor imposes may be genuinely immovable as a business fact, and it is still a Level A failure, and no auditor can make that go away by sympathising with you. What we can do is say so plainly and show you the warning and extension behavior you can still build around it.

Two other things people assume are part of this rule are not, and both sit at Level AAA, which is outside the 55 rules our audits grade. Preserving what the user typed is its own rule. So is letting them re-authenticate and carry on where they left off, which is the exact scenario in the paragraph above. We test both because they matter more to your customer than the level does, and we mark them as observations rather than conformance findings so nobody files a AAA nice-to-have as a legal exposure.

One warning if data preservation is the route you pick. The standard attaches a note to it about consent. Holding a half-finished form full of somebody's details is a privacy decision before it is an accessibility one, and it gets sharper where the user might be a minor. Talk to whoever handles that at your end before you build it.