Problem/Motivation
On the mobile version, the "modal" overlay for the expanded sidebar has an invalid ARIA attribute: aria-expanded.
Accessibility Insights report
Title: WCAG 4.1.2: Ensure an element's role supports its ARIA attributes (.admin-toolbar-overlay) Tags: Accessibility, WCAG 4.1.2, aria-allowed-attr Issue: Ensure an element's role supports its ARIA attributes (aria-allowed-attr - https://accessibilityinsights.io/info-examples/web/aria-allowed-attr) Target application: admin | Drush Site-Install - https://drupal-core-dev.ddev.site/user/1/edit?pass-reset-token=3M28uFtT7L8cxINMn9OnEPObJbFuTcfPcIyVtmtD9LfeLhvgzJJRDLLVO4s-3MZxDbqgcDOnOQ&check_logged_in=1 Element path: .admin-toolbar-overlay Snippet: <div class="admin-toolbar-overlay" aria-controls="admin-toolbar" data-drupal-admin-styles="" data-once="admin-toolbar-trigger" aria-expanded="true"></div> How to fix: Fix all of the following: ARIA attribute is not allowed: aria-expanded="true"
Screenshot

WCAG success criteria
Steps to reproduce
- Do a standard installation.
- Enable the navigation module.
- Log in as admin.
- Go to a page that has the navigation sidebar.
- Reduce the viewport width until the "mobile" version of the sidebar is displayed (currently ~1000px).
- Expand the sidebar if it's closed.
- Run a test with Axe or Accessibility Insights.
Code snippet
<div class="admin-toolbar-overlay" aria-controls="admin-toolbar" data-drupal-admin-styles="" data-once="admin-toolbar-trigger" aria-expanded="true"></div>Proposed resolution
The problem appears to be that the overlay is a simple div with no special role, but it's a pseudo disclosure widget control. The sidebar looks like a hybrid disclosure widget / modal dialog.
aria-expanded can only be used on certain roles.
The web.dev native dialog example doesn't close on a click outside the dialog, so that's not a helpful example.
The Modal Dialog Example of the ARIA Authoring Practices Guide (APG) uses a similar modal overlay ("backdrop") that does not have aria-expanded or aria-controls.
Based on the APG example, I propose:
- Remove the
aria-expandedattribute. - Possibly also remove the
aria-controlsattribute. - Update the accessibility test to also check with the sidebar expanded on a smaller viewport.
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
| Comment | File | Size | Author |
|---|---|---|---|
| #25 | 3551528-25-local-test-axe-invalid-attribute-error.png | 311.35 KB | kentr |
| Screenshot 2025-10-10 at 10.29.44 AM.png | 504.31 KB | kentr |
Issue fork drupal-3551528
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
shqshqnk commentedI am starting on it
Comment #5
shqshqnk commentedI have removed the invalid aria attributes as well as Moved the overlay to be before the sidebar so that clicking on the overlay shifts the focus back to the sidebar
Comment #6
kentr commentedStill needs the test updated, or a new test, to prove that it's fixed.
@shqshqnk
Please explain this. It sounds like a separate problem that should be in another issue.
Comment #8
mgiffordIn discussion with @mherchel @rkoller & @kat-shaw we decided that this was a barrier. This just is semantically wrong and needs to be addressed.
Comment #10
mherchelHiding previous branch. It's out of date, doesn't address the JS changes, and also doesn't point to
mainNew branch incoming.
Comment #13
mherchelThis should be good to go and is ready for review.
Comment #14
rkollerchecked out the MR and the aria-expanded attribute is getting properly removed. looks good to me.
Comment #15
smustgrave commentedThis is one would ask if we could maybe add a small assertion to an existing test. Since aria bugs popup frequently
Comment #16
mherchel@smustgrave This would be better served by modifying existing accessibility tests. Sure we can test one specific element if it has aria-expanded. But, there's no reason it would ever be added, except on purpose.
If we test this one
<div>for aria attributes, who's to say that we should test all<div>'s and other elements?Comment #17
mherchelSetting to NR to get additional feedback.
Comment #18
smustgrave commentedBut isn’t this just targeting navigation? Think an assertion could be added to that
Comment #19
mherchelI'm a bit confused. What do you want to test? The only thing that I can think of is that the
aria-expandedattribute does not exist.If thats the case, I'm not sure what the point is. There's almost a zero percent chance someone will add that back. And if we do test for invalid aria-expanded attributes. Why stop at just this element, and just that attribute?
Comment #20
smustgrave commentedI’ll look at this again later this week
Comment #21
kentr commentedNot sure if this is what @mherchel meant, but Navigation has its own "general" accessibility test..
The test appears to lack coverage for the "mobile" version, though. I suspect it would have caught this issue if it had coverage.
There's support in #accessibility for expanding Axe test coverage, so I propose adding coverage of the "mobile" version to that test (or as separate test in the same file, since the setup is a little different for "mobile").
I'm happy to do the work, but I might not finish it for a couple of days.
Comment #22
smustgrave commentedDisregard my previous comments. Sees only bit missing from the summary is
Update the accessibility test to also check with the sidebar expanded on a smaller viewport.
Correct?
Comment #23
kentr commented@smustgrave:
Heh. I forgot that was in the issue summary...
Yes, I'd say that's correct.
Comment #24
kentr commentedComment #25
kentr commentedI extended the Axe test to cover the expanded "mobile" sidebar.
There was random test failure that passed when re-run.
I ran the modified test against
main, and it did catch the invalid attribute.The Test Only job passed (false negative), but it looks like there's an underlying problem with the job and the tests didn't even run.
Here's a screenshot of the local test output showing the invalid attribute failure message from Axe:
Commands to run the single test against
main:Comment #26
kentr commentedApparently there's no underlying problem.
Looks like the Test Only job only runs PHPUnit.
Comment #27
bernardm28 commentedSeems like a good workaround
Comment #31
lauriiiCommitted! 🚀