WebAIM - Web Accessibility In Mind

E-mail List Archives

RE: Section 508 1194.22(p)

for

From: Paul Bohman
Date: Mar 15, 2002 5:14PM

Sharon, you have asked some good questions.

>> First of all, is a timed response the same as the "time-out" for
inactivity?

A strict interpretation of the law would say that yes, this is a timed
response. Some people (including myself) will argue that tome-outs must
be allowed under some circumstances (e.g. where security is very
important). Still, it is possible that you will exclude some people with
certain disabilities if you set a time-out, no matter how long the
interval is. It then becomes a question of where you draw the line.

>> And if so, if you can't use Javascript (or if it also has to work
without Javascript, too) - how would you alert the user using a server
side language?

You really can't. At least I can't think of a way. (I assume that you're
talking about server side languages such as JSP, PHP, Cold Fusion, Perl,
Python, ASP and the like.)

>> If we set a 15 minute time out for inactivity on the server side,
does it only keep track of activity such as a submit button, or next
page.

You are correct: If you set the time limit server-side, then you can
only keep track of events that are sent to the server. If someone
submits a page 16 minutes after the timer begins, then the page is late
and you can send back an error message.

>> If it is server side it can't track mouse activity or keystrokes - is
that correct?

To the best of my knowledge, that is correct.

>> So the user would have to fill out a form within the 15 minutes in
order to not time out.

Correct.

>> How would you let them know their time is almost up and let them
request more time?

You could post a text message telling them that their time will expire
in 15 minutes, but if you don't use client-side scripting of some sort,
you can't notify them until they submit the page.

>> The vendor is talking about writing a java applet that the user would
have to download in order to track the time. Is that the best way?

That will probably perform the necessary function, but it may not do it
in an accessible format. Your dilemma is a real-life example of someone
with good intentions (you) trying to design an accessible Web feature
within the constraints of other design considerations. Here are a few
thoughts:

Overall, Java is less accessible than JavaScript. If a time-out really
is necessary, then I would be inclined to set a timer both server-side
and client-side JavaScript.
* The server side script will generate an error message if the page is
submitted after the time out deadline. This will accomplish the goals of
your time-out functionality. You could also have a message at the top of
the page which says "You must submit this page in 15 minutes. If you
need more time, select the 'more time needed' button below." You could
then offer them more time (30 minutes, for example). It may or may not
be possible to offer them that much time. I don't know your
circumstances.
* You could also use a client-side JavaScript which will alert users
when they have 5 minutes left, and then the script could redirect the
page at the end of the time-out period. Most users of JAWS, Window Eyes,
and Home Page Reader will be able to access the JavaScript popup
messages. Some people will not, either because they are using a
different technology, or because they have JavaScript turned off. You
can't avoid this. The JavaScript will simply be inaccessible to a
portion of the population.
* Using Java will not solve any part of the accessibility problem. It
may make it possible to do time-outs, but people with disabilities will
not benefit from Java, especially in comparison to JavaScript, which is
somewhat more accessible when used wisely.


>> Or maybe I am interpreting this all wrong and the "timed response" is
not the same as a time-out for inactivity?

I believe that your interpretation is correct. You are also correct to
be concerned, but, as I said before, I believe that there are
circumstances in which the rules may need to bend a bit. You can't have
unlimited time to fill out a form and tight security at the same time.
You have to compromise one or the other.

The real question that you need to ask is "Is a time-out necessary?" If
it is, then you can follow my suggestions above, or come up with some
other creative workarounds. If it isn't necessary, then your problem is
solved: don't include a time-out.

Paul Bohman
Technology Coordinator
WebAIM (Web Accessibility in Mind)
www.webaim.org
Center for Persons with Disabilities
www.cpd.usu.edu
Utah State University
www.usu.edu





----
To subscribe, unsubscribe, or view list archives,
visit http://www.webaim.org/discussion/