Cyber Security Trends, Research & Analysis Blog | F5 Labs

Application services | F5

F5 Distributed Cloud Bot Defense | F5

Support Services | F5

Secure, Cloud-Based DNS as a Service | F5

Healthcare Cybersecurity Solutions | F5

F5 Distributed Cloud App Stack | F5

F5 | Segurança multinuvem e entrega de aplicações

F5 | Seguridad multi-cloud y entrega de aplicaciones

First time visit: View without clicking anything

All controls on the page - including links, buttons, and fields - should show when 
they have been selected by the keyboard.

You can confirm this yourself by loading a webpage and using the Tab key to navigate 
through it. Anything you can select should alter its appearance when selected. 
For example, a text field might change color, or have a distinctive border applied. 

This is default behavior for all standard web controls, and so if this issue is appearing
it is because this default behavior has been disabled. Or alternatively, if you have written
your own custom controls, these will need styling to support focus states.

## How to fix

Links and form controls typically define an `outline` CSS style, which ensures
they are highlighted automatically, for example:

```css
input:focus (outline: 2px solid red);
``` 

If you choose to override or disable the default `outline`, you should specify an accessible 
alternative, such as a border or background color.

### Elements appear to change in the browser

Focus states should be defined in CSS alone, and not require JavaScript to work.

Try disabling JavaScript on the page, and see if focus is still visible. If it not,
then the focus state won't work with assistive technologies that don't have a physical
keyboard, e.g. mobile phones.

Some more unusual means of implementing a focus state cannot be detected or measured
automatically. These include:

* Focus implemented via pseudo-elements - such as `::after` or `::before`.
* Focus using `:focus-within` (JavaScript current provides no way to access these).
* Focus cascaded to child elements, e.g. a `<span>` inside an `<a>` tag. We detect
  some of these cases, but there are variations that we cannot detect.

Currently, there is no practical way to assess these focus states automatically.

### Unexpected elements are focusable

You may be surprised to see tags like `<div>` or `<span>` being shown as focusable.
If an element has a `tabindex` of 0 or higher, it becomes focusable. Any HTML tag can be made 
focusable in this way, this is so that custom controls (e.g. your own drop-down menus, or 
sliders) can support keyboard navigation. [Learn more about tabindex on MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/tabindex).

## Further reading

* [WCAG 2.4.7](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html)

ensure-focus-is-visible

June 2024

May 2024

F5 Networks

Title / URL	Issues
Cyber Security Trends, Research & Analysis Blog \| F5 Labswww.f5.com/labs	6
Application services \| F5www.f5.com/products	4
F5 Distributed Cloud Bot Defense \| F5www.f5.com/cloud/products/bot-defense	4
Support Services \| F5www.f5.com/support	4
Secure, Cloud-Based DNS as a Service \| F5www.f5.com/cloud/products/dns	4
Healthcare Cybersecurity Solutions \| F5www.f5.com/solutions/healthcare	4
F5 Distributed Cloud App Stack \| F5www.f5.com/cloud/products/appstack	4
F5 \| Segurança multinuvem e entrega de aplicaçõeswww.f5.com/pt_br	2
F5 \| Seguridad multi-cloud y entrega de aplicacioneswww.f5.com/es_es	2
First time visit: View without clicking anythingwww.f5.com/	2

Ensure controls change appearance when they are selected

F5 Networks

Where this issue has occurred