How to fix: session timeouts without warning

What it looks like in the wild

Form data is lost when an idle session expires without warning.

The screen-reader user, keyboard user, or low-vision user encountering this issue does not get an error message. The page just stops working for them. Which is why this kind of bug rarely shows up in your error tracker; it shows up in support tickets, lawsuits, and abandoned conversions.

Why it fails WCAG

Cognitive accessibility users need warning + extension.

The wrong pattern (avoid)

setTimeout(() => location.href = '/logout', 600000);

The right pattern (copy this)

// 9 minutes: warn
// 10 minutes: log out (unless extended)
showWarningDialog({ extend: () => resetTimer() });

Notes from real audits

• Warn at 80% of the timeout window — at 4 minutes into a 5-minute session, for example.

• The warning dialog itself must be keyboard accessible and focusable, or users with motor disabilities may not reach it in time.

• Authentication timeouts for security reasons are exempt, but you should still warn and offer a re-authentication path.

• Store form data in sessionStorage during the session so users do not lose input even when a timeout occurs.