Dragging Movements and Accessible Authentication

WCAG 2.2 also tackles two everyday pain points: drag-only interactions and logins that demand memory or puzzles. Both block real users.

Criterion 2.5.7 (Dragging Movements) at AA says any drag action must also work with a single pointer, like a tap or click.

People using a head pointer, switch, or with limited motor control often cannot drag. A drag-only slider or kanban board locks them out.

For a reorder list, add up and down buttons beside each item. The drag stays for mouse users; the buttons serve everyone else.

A custom slider should respond to arrow keys or plus and minus buttons, not just a dragged thumb, to satisfy 2.5.7.

Criterion 3.3.8 (Accessible Authentication) at AA bans tests that rely on a cognitive function step, unless an alternative exists.

That means no forcing users to solve a puzzle, transcribe characters, or recall a password from memory as the only way in.

Allowing paste into the password field and not blocking autofill is a simple, compliant path. Do not break the user agent.

An honest autocomplete token lets browsers and password managers fill credentials for the user.

Object-recognition CAPTCHA is allowed because recognizing objects is not a cognitive function test, but always provide a non-puzzle option.

A magic login link sent to email passes, since the user only clicks. It removes the memory step the criterion warns against.

Pick what dragging-based controls must always offer under 2.2.

Always pair drag with a single-pointer path, and never gate login behind a memory or puzzle test. Next: writing a conformance statement. 🎯