Add WCAG 2.2 SC 3.3.9 - Accessible Authentication (Enhanced) (AAA)

[mgifford]

WCAG 2.2 SC 3.3.9:

A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:

Alternative
Another authentication method that does not rely on a cognitive function test.

Mechanism
A mechanism is available to assist the user in completing the cognitive function test.

List the tasks for the SC.

Child issue of #65

[mgifford]

Role mapping by ChatGPT and links mostly from me.

AI Generated Role Mapping (ARRM)

• Primary: UX Designer – ensures no step of authentication requires solving, recalling, or recognizing information.
• Secondary: Front-End Developer – implements fully accessible alternatives (passkeys, autofill, biometrics).
• Contributor: Visual Designer – communicates authentication options clearly and consistently in the interface.

AI Generated Additional Context

• Stronger than 3.3.8: no reliance on cognitive function tests at any step. This includes memorization, transcription, puzzles, object recognition, and identifying user-provided images/media.
• Provide at least one non-cognitive method such as passkeys/biometrics or manager-compatible username/password with copy-paste and autofill enabled.
• Common failures: blocking password managers, disabling paste, using image-recognition CAPTCHAs, or requiring users to identify pictures they previously uploaded.

References

• GetStark: Accessible Authentication (Enhanced) – overview and examples
  https://www.getstark.co/wcag-explained/understandable/input-assistance/accessible-authentication-enhanced/
• W3C Understanding 3.3.9 – official guidance
  https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-enhanced.html
• BeAccessible – WCAG 2.2 checklist
  https://beaccessible.com/post/wcag-2-2-checklist/
• Parachute Design – WCAG 2.2 overview
  https://parachutedesign.ca/blog/wcag-2/#Success_Criteria_327_%E2%80%9CVisible_Controls%E2%80%9D
• Equally AI – WCAG 2.2 checklist
  https://blog.equally.ai/web-accessibility/wcag-2-2-simple-checklist/
• W3C ARRM – Accessibility Roles & Responsibilities Mapping
  https://www.w3.org/WAI/planning/arrm/

Possible Task List

• Define requirement: no image/media puzzles in auth flows
• Identify and document valid alternative methods (e.g., password managers, WebAuthn, biometrics, paste-enabled fields)
• Define mechanism to assist with cognitive tests if unavoidable (e.g., show “paste code” option, allow password managers, provide help)
• Specify markup and semantics for login fields (properly marked username/password fields) and allow paste
• Implement WebAuthn, biometric options, support clipboard actions for verification codes
• Enable paste and auto-fill; remove artificial barriers (e.g., prevent blocking paste)
• Test authentication flows including alternatives on real devices and assistive tech; include cognitive-impaired user testing
• Document conformance in accessibility statement and dev guidelines