Re-authenticating ensures that users do not lose their work or context when an authenticated session expires. If users are logged out due to inactivity or security checks, they must be able to re-authenticate and continue their activity without losing data or progress.
This criterion exists because many users need more time to complete tasks, and forced logouts can interrupt activities in ways that are difficult or impossible to recover from.
WCAG Success Criterion
3.3.7 Re-authenticating (Level AAA)
When an authenticated session expires, the user can continue the activity without loss of data after re-authenticating.
Why This Matters
Authenticated sessions commonly expire due to security policies such as inactivity time limits, parallel logins, or suspicious activity detection. When this happens during an in-progress task, users may lose:
- Entered form data
- Shopping cart contents
- Drafts or partially completed submissions
- Their place in a multi-step process
For many users, restarting the task may be frustrating or infeasible. For others, it may prevent task completion entirely. Session expiration is especially disruptive when users are not warned, cannot extend the session, or cannot recover their previous work after logging back in.
Intent of the Criterion
This success criterion intends to ensure that session security mechanisms do not erase user effort.
This criterion does not prevent sites from enforcing session time limits or requiring re-authentication. Instead, it requires that when re-authentication occurs, users can resume their activity without losing data or context.
This includes scenarios where users are logged out because:
- They were inactive for a period of time
- They logged in from another device
- The system detected unusual activity
In all cases, users must be able to re-authenticate and return to the same task state they were in before the session ended.
Relationship to Timing Requirements
Re-authentication mechanisms are still subject to other WCAG timing criteria, including:
- SC 2.2.1 Timing Adjustable (Level A) — users must be warned and allowed to extend time limits where applicable
Meeting SC 3.3.7 does not remove the obligation to provide warnings or extension options for session timeouts.
Who This Helps
This criterion primarily supports users who:
- Have cognitive or learning disabilities and need more time to read and respond
- Use screen readers and require extra time to navigate complex forms
- Have motor or mobility impairments that slow interaction
- Use alternative input devices that increase task completion time
These users are disproportionately affected by forced logouts that discard in-progress work.
Common Failure Patterns
Re-authentication failures often occur when:
- Form data is cleared after login expiration
- Users are redirected to the home page after re-authentication
- Drafts are lost and must be recreated
- Multi-step workflows restart from the beginning
- Re-authentication opens in a new context, abandoning the original task
In these cases, users technically regain access, but cannot continue their activity.
Examples
Shopping site checkout
A user is logged into a shopping site and begins the checkout process. The user steps away before completing payment, and the session expires.
When the user returns and logs in again, the checkout process is restored to the same step with the same information. No entered data is lost.
Email composition
An email application logs users out after a fixed period. Before expiration, the application warns the user and offers a re-authentication option.
If the session expires, the user logs in again and returns to the draft email exactly as it was before logout.
Rule Description
When users are required to re-authenticate due to session expiration or security checks, they must be able to continue their activity without losing entered data or progress.
Re-authentication must restore users to the same task state whenever feasible.
The Algorithm
- Identify pages or workflows that require authentication
- Trigger a session expiration during an in-progress task
- Require the user to re-authenticate
- After authentication:
- Verify that the entered data is preserved
- Verify that the user returns to the same task and step
- If data or progress is lost, the criterion fails
Wrapping Up
Re-authenticating at Level AAA is not about removing security controls. It is about respecting user effort. If users are logged out while completing a task, accessibility requires that they can log back in and continue without starting over. Losing data, progress, or context after re-authentication creates unnecessary barriers, especially for users who need more time to interact with content.
Security and accessibility are not in conflict here. With proper session handling, both can be achieved.
