# Expire the session just after the user presses Submit

Test both rejected access and an uncertain write outcome. Recovery must preserve the draft without creating a second business action.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Establish a traceable submission

Prepare a synthetic draft with a long description and a stable command ID. Record how the test can locate the resulting business record independently of the browser.

First expire authentication before the server authorises the request. Confirm that the action is rejected, the draft remains recoverable and the user receives a clear sign-in path.

Reauthenticate as the same account and complete the workflow. Check that the original values survive and that current validation still runs.

## Lose the response after a successful write

In a separate case, allow the server to commit the command and then interrupt the response. Expire the session before the client resolves that uncertainty.

After sign-in, the application should discover the original result or retry safely against the same command identity. Expect one business record even if several network attempts occurred.

Do not consider the case passed merely because the user reaches a success screen. Inspect the server records and any external effect to detect duplicates.

## Return as a different account

Pause with an account-A draft and sign in as account B. The old draft should not appear or submit under B's authority. The interface should explain the context mismatch without exposing sensitive contents.

Repeat with the same person switching organisations, and with the original account's permission revoked during the interruption. Authentication success must not bypass the current authorisation check.

Keep one other browser tab open. Confirm that stale cached data and pending requests cannot restore the old account's content after the switch.

## Exercise timing and navigation

Test any expiry warning with keyboard and representative assistive technology. The warning should be discoverable and operable, and a permitted extension should behave according to the server policy.

Manipulate an untrusted return destination in a controlled test. The application should reject external or invalid routes rather than redirecting blindly after sign-in.

Finally, use browser Back and refresh around the recovery screen. The user should not become trapped in a sign-in loop or accidentally resubmit a completed command because the page history contains an old pending state.

## Sources

- [OWASP: session management](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
- [W3C WAI: timing adjustable](https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html)