Web Development Accessibility

The Problem

At the university, small web development teams, i.e. of one to three people, or new developers, i.e. co-op students, generally don’t have all the frontend and backend knowledge to meet the legal obligations required of the university. It would be useful to have a resource that lists valuable development tools, i.e. validation or testing software and, tutorials. These tools would provide a relatively quick way for the developer to know if their web application (web app) meets the legal requirements etc.

This page is an attempt to get that started. Therefore, it will not represent all obligations, or changes to those obligations.

Note, that UW’s central computing group, IST, has:

The Tools

User Interface (ui)

There are several approaches and philosophies to enhancing a web ui:

Each has their strengths and weaknesses. For example, some issues surrounding ui and accessibility are:

  • extensive use of javascript to rebuild sections of the webpage doesn’t allow screenreaders to inform the user that content changed and also affects tab order

  • extensive use of RWD, and mobile first, can disorder screen elements, i.e. tables ['Tables, CSS Display Properties, and ARIA,' http://adrianroselli.com/2018/02/tables-css-display-properties-and-aria.html, by Adrian Roselli]

  • note, this field is young and as it matures hopefully, these issues will be solved.

Whichever one you choose, ensure that it satisfies the WCAG2 specification, http://www.w3.org/TR/WCAG20/. For those who are keen, here is a peak into the future, 'WCAG 2.1: What does it actually mean?,' https://frontside.io/blog/2018/06/14/what-is-new-in-wcag-2-1.html.

My approach tends toward using PE. This architecture makes accessibility easier since it relies on having solid semantic html at the core. Therefore, I look for solutions that follow this architecture.

The tools and tutorials:

Guides:

UW Common Look and Feel (clf) for web apps:

Accessibility

Guides:

These css frameworks have references to online contrast checkers and summaries of how they use the ARIA attributes, etc:

Components:

PDFs:

  • what tool is available to check your pdf to ensure it is accessible?

    • this would be useful for staff and writers

  • Chris Francis commented that the built in Adobe and Word tools are good and, "They definitely aren’t as good as the web ones. As an example, both of these fail colour contrast checking, while many of the web ones will catch it. That said, the web ones still don’t catch everything. Nothing I know of catches reading order, poor wording, or anything like someone using text as an image."

  • 'Create and verify PDF accessibility (Acrobat Pro),' https://helpx.adobe.com/acrobat/using/create-verify-pdf-accessibility.html

  • PDF Accessibility Checker (PAC 3), http://www.access-for-all.ch/en/pdf-lab/pdf-accessibility-checker-pac.html

  • where possible, consider converting the pdf to a webpage.

Web testing:

Graham Faulkner suggestions:

Security

Although focusing on php, many of the suggestions are valid for other programming languages:

Databases and record representations on the web:

  • are UUIDs useful as reference keys in datatables to assist with get url ids?

Penetration testing:

  • IST will test a web app

  • however, it is essential that other UW developers have easy and timely access to a standard penetration testing tool, so that developers can fix the basics before IST’s testing

    • preferably open source

    • Pat Matlock suggested Arachni, http://www.arachni-scanner.com/:

      • "Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications."

Data

Managing data involves the processes that your app uses to input, massage, keep and delete data. The European Union’s General Data Protection Regulation (gdpr) has recently been introduced to protect the data of European citizen’s. [It is also useful for other countries' users as well.] I think the best summary that I have seen of how to handle data is from reddit:

[–]NiteLite
I am one of many working on GDPR compliance at our company, and I am not worried about article 5.

It is not that complicated:
a) Don't try to be sneaky, stick to the law. Tell the user what data you collect and why.
b) Don't use PII [Personally Identifiable Information] for other stuff than what you told the user.
c) Don't collect more info than you need "just in case you might need it in the future".
d) Make sure the data you collect is kept up to date.
e) Get rid of data if you no longer need it to perform the task you told the user about.
f) Make sure only authorized people have access to the data.

Here are some point by point discussions' that will give you an idea of its scope:

Tools for gdpr:

 — MarlonAGriffith - 19 Mar 2018