2.2.5: Re-authenticating

What it means

When a session expires, users should be able to re-authenticate and continue without data loss. Losing a long form because a login timed out is a common and avoidable frustration.

This AAA requirement applies after authenticated sessions time out.

How to fix it

• Save draft form data server-side or in local storage before session expiry.
• After re-login, return users to the same step with fields restored.
• Show a clear message explaining that data was preserved.
• Test timeout on long admin forms and checkout flows.

Quick examples

• Good: After re-login, a user returns to checkout with cart and address fields intact.
• Bad: Session timeout clears a 20-minute grant application with no recovery.
• Good: A warning lets users save progress before the session ends.
• Bad: Re-authentication sends users to the homepage with an empty form.