WebAIM - Web Accessibility In Mind

E-mail List Archives

Re: Section 508 1194.22(p)

for

From: Sharon Daniels
Date: Mar 18, 2002 6:17AM

Paul -

Thanks so much for all this information. I will run all this by the
developers. A time out is necessary for us because people will be using
this application in public places and they will have to enter confidential
information. We need it to time out in case the user gets up in the middle
and walks away without getting out of the application. It's not totally
fool-proof but a small measure to try to keep the information as
confidential as possible.

----- Original Message -----
From: "Paul Bohman" < <EMAIL REMOVED> >
To: < <EMAIL REMOVED> >
Sent: Friday, March 15, 2002 7:14 PM
Subject: RE: Section 508 1194.22(p)


> Sharon, you have asked some good questions.
>
> >> First of all, is a timed response the same as the "time-out" for
> inactivity?
>
> A strict interpretation of the law would say that yes, this is a timed
> response. Some people (including myself) will argue that tome-outs must
> be allowed under some circumstances (e.g. where security is very
> important). Still, it is possible that you will exclude some people with
> certain disabilities if you set a time-out, no matter how long the
> interval is. It then becomes a question of where you draw the line.
>
> >> And if so, if you can't use Javascript (or if it also has to work
> without Javascript, too) - how would you alert the user using a server
> side language?
>
> You really can't. At least I can't think of a way. (I assume that you're
> talking about server side languages such as JSP, PHP, Cold Fusion, Perl,
> Python, ASP and the like.)
>
> >> If we set a 15 minute time out for inactivity on the server side,
> does it only keep track of activity such as a submit button, or next
> page.
>
> You are correct: If you set the time limit server-side, then you can
> only keep track of events that are sent to the server. If someone
> submits a page 16 minutes after the timer begins, then the page is late
> and you can send back an error message.
>
> >> If it is server side it can't track mouse activity or keystrokes - is
> that correct?
>
> To the best of my knowledge, that is correct.
>
> >> So the user would have to fill out a form within the 15 minutes in
> order to not time out.
>
> Correct.
>
> >> How would you let them know their time is almost up and let them
> request more time?
>
> You could post a text message telling them that their time will expire
> in 15 minutes, but if you don't use client-side scripting of some sort,
> you can't notify them until they submit the page.
>
> >> The vendor is talking about writing a java applet that the user would
> have to download in order to track the time. Is that the best way?
>
> That will probably perform the necessary function, but it may not do it
> in an accessible format. Your dilemma is a real-life example of someone
> with good intentions (you) trying to design an accessible Web feature
> within the constraints of other design considerations. Here are a few
> thoughts:
>
> Overall, Java is less accessible than JavaScript. If a time-out really
> is necessary, then I would be inclined to set a timer both server-side
> and client-side JavaScript.
> * The server side script will generate an error message if the page is
> submitted after the time out deadline. This will accomplish the goals of
> your time-out functionality. You could also have a message at the top of
> the page which says "You must submit this page in 15 minutes. If you
> need more time, select the 'more time needed' button below." You could
> then offer them more time (30 minutes, for example). It may or may not
> be possible to offer them that much time. I don't know your
> circumstances.
> * You could also use a client-side JavaScript which will alert users
> when they have 5 minutes left, and then the script could redirect the
> page at the end of the time-out period. Most users of JAWS, Window Eyes,
> and Home Page Reader will be able to access the JavaScript popup
> messages. Some people will not, either because they are using a
> different technology, or because they have JavaScript turned off. You
> can't avoid this. The JavaScript will simply be inaccessible to a
> portion of the population.
> * Using Java will not solve any part of the accessibility problem. It
> may make it possible to do time-outs, but people with disabilities will
> not benefit from Java, especially in comparison to JavaScript, which is
> somewhat more accessible when used wisely.
>
>
> >> Or maybe I am interpreting this all wrong and the "timed response" is
> not the same as a time-out for inactivity?
>
> I believe that your interpretation is correct. You are also correct to
> be concerned, but, as I said before, I believe that there are
> circumstances in which the rules may need to bend a bit. You can't have
> unlimited time to fill out a form and tight security at the same time.
> You have to compromise one or the other.
>
> The real question that you need to ask is "Is a time-out necessary?" If
> it is, then you can follow my suggestions above, or come up with some
> other creative workarounds. If it isn't necessary, then your problem is
> solved: don't include a time-out.
>
> Paul Bohman
> Technology Coordinator
> WebAIM (Web Accessibility in Mind)
> www.webaim.org
> Center for Persons with Disabilities
> www.cpd.usu.edu
> Utah State University
> www.usu.edu
>
>
>
>
>
> ----
> To subscribe, unsubscribe, or view list archives,
> visit http://www.webaim.org/discussion/
>


----
To subscribe, unsubscribe, or view list archives,
visit http://www.webaim.org/discussion/