{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "accessible-login-assistance-check",
  "group": "portal",
  "title": [
    "Let customers use their login assistance tools",
    "登录验收，要允许客户使用辅助工具"
  ],
  "intro": [
    "A portal can be secure while allowing password managers and paste. Before commissioning custom sign-in controls, define how customers can authenticate without an unnecessary memory or transcription task. Do not treat a paste-blocking script as evidence of security.",
    "资料门户可以在允许密码管理器和粘贴的同时保持安全。制作定制登录控件前，应约定客户怎样避免不必要的记忆或抄写负担；禁止粘贴的脚本不代表安全。"
  ],
  "facts": [
    [
      "WCAG accessible-authentication guidance identifies password-manager support and copy/paste as ways to reduce cognitive burden, within the criterion’s stated alternatives and exceptions.",
      "WCAG可访问身份验证指导把密码管理器及复制粘贴列为减轻认知负担的方法，具体替代与例外以原文为准。",
      "https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html"
    ]
  ],
  "columns": [
    [
      "Synthetic sign-in journey",
      "Acceptance action",
      "Expected outcome"
    ],
    [
      "合成登录流程",
      "验收动作",
      "预期结果"
    ]
  ],
  "example": [
    [
      [
        "Existing account; saved credentials",
        "Password manager fills username/password",
        "Fields accept input; normal validation runs"
      ],
      [
        "已有账户及已存凭证",
        "密码管理器填写用户名和密码",
        "字段接受，正常验证执行"
      ]
    ],
    [
      [
        "Standalone password manager",
        "Paste password",
        "No arbitrary paste rejection"
      ],
      [
        "独立密码管理器",
        "粘贴密码",
        "无任意粘贴拦截"
      ]
    ],
    [
      [
        "One-time code message",
        "Paste complete code",
        "Supported code entry without forced manual retyping"
      ],
      [
        "一次性验证码通知",
        "粘贴完整代码",
        "受支持录入，无须强制逐字重打"
      ]
    ],
    [
      [
        "Invalid credentials",
        "Submit through assisted input",
        "Honest error; no false authenticated state"
      ],
      [
        "错误凭证",
        "辅助录入后提交",
        "真实错误，不冒称登录成功"
      ]
    ]
  ],
  "steps": [
    [
      "Ask the authentication supplier which native field purposes and supported assistance paths it provides. Include challenge alternatives and recovery access in the brief without inventing a universal CAPTCHA solution.",
      "向身份供应商确认原生字段用途及支持的辅助路径，说明挑战替代和恢复入口，但不能编造通用验证码方案。"
    ],
    [
      "Use dummy accounts to test autofill, paste, keyboard and the complete multi-step flow on the supported browser set. Do not record actual passwords or reusable codes in evidence.",
      "用测试账户演练自动填写、粘贴、键盘及完整多步流程，证据不能记录真实密码或可重用代码。"
    ],
    [
      "Check that assistance does not bypass normal validation or authorisation. Review focus, error feedback and re-entry after a failed attempt together with the security owner.",
      "辅助输入仍须经过正常验证与授权；与安全负责人一起核对焦点、错误反馈及失败后的再次操作。"
    ]
  ],
  "result": [
    "The acceptance question is whether assistance works throughout authentication, not whether a form has an autocomplete attribute. A one-time-code UI that accepts paste into only its first of six boxes may need a different design. Test the complete outcome before approving a polished mockup.",
    "验收是辅助工具能否贯穿完整验证，不是有无autocomplete属性。六格验证码若只把粘贴内容放进第一格，可能需要改设计；不能凭精致样稿批准。"
  ],
  "accept": [
    "Require successful assisted sign-in and correct failure handling without exposing secrets. Recovery-token lifecycle and tenant permissions remain separate tests.",
    "须证明辅助登录成功且错误处理正确，不泄露秘密；恢复令牌生命周期及租户权限另行验收。"
  ],
  "limit": [
    "Synthetic journeys only; no real sign-in or credential entry performed. This does not certify an identity provider or weaken MFA, password, browser or security policies.",
    "仅为合成流程，没有真实登录或输入凭证；不认证身份供应商，也不削弱MFA、密码、浏览器或安全策略。"
  ]
}