WCAG 2.0 · Level AAA · Operable
2.2.5 Re-authenticating
Manual verification
How to validate 2.2.5 by hand
Check that an authenticated session can be resumed after it expires without loss of entered data.
Start with the extension result
Reopen the reported URL and reproduce the same state (for example, after expanding a menu or submitting a form). Use the result’s Highlight action when available, or its affected-element details and CSS selector, to find the reported content. Apply the checks below to that content and its context. If the element or state has changed, rescan and record that difference before deciding whether the finding still applies.
- Enter representative data into a protected workflow and allow the authenticated session to expire.
- Re-authenticate using the normal process and return to the same task.
- Verify previously entered data is restored and that the user can continue without re-entering it.
Evidence to record
Record the workflow, data entered, expiry behavior, re-authentication steps, and which data or position was lost.
Scope and exceptions
This is Level AAA and applies to re-authentication after session expiry. Security requirements may affect implementation but do not remove the need to examine the criterion’s data-preservation requirement.
Record the review outcome
- Confirmed: the recorded evidence shows the requirement is not met in the tested page state, and no applicable exception explains it.
- Not reproduced: the reported issue is absent in the current state. Record the URL, state, and affected element you checked; this does not prove other pages or states conform.
- Needs more review: evidence is incomplete, the content requires human judgment, or an exception is uncertain. Record what remains to be checked instead of treating it as a pass.