• Success Criterion 3.3.8
  • Conformance level AA

Email Magic-Link Login That’s Broken or Expires Instantly

3.3.8 — Accessible Authentication (Minimum)

Scenario

Setting

A hotel booking site's room-selection page

What’s wrong

Email magic-link offered but broken/expired instantly, leaving cognitive-test path as the only working method.

Example 

// magic link email is sent, but the token expires 30 seconds after being generated
function verifyMagicLink(token) {
  if (Date.now() - token.createdAt > 30000) {
    return { error: 'Link expired, please log in with your password' };
  }
}

Why it matters

A guest who chose the magic link specifically to avoid recalling a password finds it dead by the time they switch to their email app, leaving only the password path they were trying to skip.

How to test

Try the email magic-link login alternative: if it's broken or expires almost instantly, leaving the cognitive-test method as the only working path, it fails.

How to fix

Give a magic link a realistic expiry window, and keep it genuinely working as an alternative, not a decoy.

function verifyMagicLink(token) {
  if (Date.now() - token.createdAt > 900000) { // 15 minutes, not 30 seconds
    return { error: 'Link expired, request a new one' };
  }
}

Outcome

The guest clicks the link within a reasonable window and books the room without ever touching a password.

Who is affected

People with cognitive disabilities who rely on the magic-link option as their non-memorization way to sign in.

Learn more

Related scenarios