Timeouts

What are Timeouts?

Timeouts are automatic limits placed on how long someone can stay active in a system, application, or website before being logged out or their session ends. They’re typically used in environments where sensitive information is involved, such as banking sites, healthcare portals, or administrative dashboards.

Accessible timeouts refer to the design and implementation of time limits on digital content or authenticated sessions in a way that accommodates all users. The purpose is to ensure that users, particularly those with cognitive or motor disabilities, have sufficient time to complete tasks without being prematurely logged out or losing their progress. It also addresses situations where screen reader activity might not trigger standard page events that monitor user interaction.

How Do Timeouts Impact Accessibility?

Accessible timeouts are vital because people with cognitive or motor disabilities may naturally take longer to complete tasks on a digital platform.

Furthermore, screen reader activity does not always trigger page events like mouse movements and clicks, which can impact how time-out interaction is monitored by a system. This means that a user actively engaged with a screen reader might still be timed out if the system only looks for mouse or keyboard activity that typical users perform.

Without proper timeout adjustments, these users could face significant barriers, including data loss or being unable to finish critical processes.

What WCAG Success Criteria are Relevant for Timeouts?

The primary WCAG success criterion addressing timeouts is WCAG Success Criterion 2.2.1 Timing Adjustable.

This criterion mandates that for each time limit set by the content, at least one of the following must be true:

• Turn off: The user must be able to turn off the time limit.

• Adjust: The user must be able to adjust the time limit (e.g., extend it).

• Extend: The user must be able to extend the time limit.

There are exceptions to this criterion for certain real-time events or activities where adjusting the time limit would invalidate the activity.

How Do I Maximize Accessibility When I Code Timeouts?

Timeouts are important for security, but if not implemented thoughtfully, they can frustrate users or even block access for people with disabilities. To make time limits accessible while protecting user data, consider these best practices:

• Implement mechanisms to extend extensions. Give users the ability to extend their session before it expires. This can be done with a clear “Extend Session” in a timeout warning. Doing so prevents data loss and ensures users can complete tasks without unnecessary interruptions.

• Direct focus to timeout notifications: When a timeout warning or prompt appears, drive cursor focus to the timeout notification so users, especially those relying on keyboard navigation or screen readers, can easily perceive and interact with it to extend their session or log out.

• Provide clear, descriptive messaging: Explain how much time is left, what will happen when the session expires, and what users need to do to continue their activity. Use simple, plain language to make the warning easy to understand for all users.

• Ensure assistive technology compatibility: Ensure that any automated monitoring of user activity for timeouts is compatible with how assistive technologies operate, considering that screen reader activity may not always trigger typical page events.

Following these guidelines enables you to code timeouts that protect security while maintaining a smooth, accessible for all users, preventing frustration and avoiding data loss.

How Do I Test the Accessibility of Timeouts?

Keyboard Navigation

Navigate through areas with time limits (e.g., authenticated sessions, multi-page forms) using only the keyboard (Tab, Shift+Tab, Enter, Spacebar, Arrow keys). Intentionally let the session become idle and observe if the timeout warning appears, if focus is driven to it, and if you can extend the session or log out using keyboard commands. Observe if the timeout warning appears with sufficient time to react.

Screen Reader 

Use a screen reader (like VoiceOver on Mac or NVDA on Windows) on a page with time limits. Let the session idle, and when a timeout warning appears, listen carefully to ensure the screen reader announces it clearly and immediately, and that the cursor focus has moved to the timeout prompt. Try to interact with the options to extend the session or log out using screen reader commands.

What Other Ways Can I Improve Accessibility of Timeouts?

• Integrate timeout accessibility considerations into the early design and development phases for any feature involving time limits, such as login sessions, multi-step applications, or forms that require extended user input.

• Prioritize testing with various interaction speeds and screen readers to confirm that the implemented solutions effectively support users with diverse needs. Based on user feedback and thorough testing, continuously refine the timer adjusting mechanisms.