Preserve page and state after switching

What it is

A state-preserving language switch changes interface language while keeping the person in the same task, equivalent page, and safely recoverable progress instead of returning home or clearing every input. Preservation follows an explicit allowlist: locale-neutral route identity, necessary query state, filters and pagination, confirmed selections, and form drafts suitable for retention. Passwords, verification codes, payment data, one-time tokens, and unauthorized content do not cross boundaries merely in the name of preserving state.

Why it happens

Encoding identity in translated path text or maintaining unrelated page trees per language leaves the switcher guessing a target URL; a reload-based change can also destroy client state. A safe implementation maps localized paths through locale-neutral route IDs, separates serializable task state from display strings, and decides field by field which query and form values migrate. An authentication session may continue, but the destination route, object, and action still require authorization and content-availability checks. Moving an unsubmitted draft is not replaying its POST; otherwise a language switch can duplicate a payment, upload, or other side effect.

Studying it

For each critical journey, build a before-switch→allowed retention→required clearing→destination-content matrix. Cover list filters, search, pagination, scroll, step flows, unsubmitted forms, validation errors, uploads, checkout, restricted objects, and multiple tabs. Test anonymous and authenticated states, expired sessions, permission changes, missing target-language content, and front-/back-end version mismatch. Measures include home-page redirects, draft loss, duplicate submissions, unauthorized disclosure, fallback-language appearance, and recovery time. Security testing targets open redirects, query injection, CSRF, sensitive URL fields, and object-level authorization bypass.

Where it stops holding

“Same page” means the same task semantics, not guaranteed word-for-word content in every language. If a target page is missing, remain in the task and label fallback content, provide an available summary, or explain unavailability instead of pretending success or silently redirecting home. High-risk steps can intentionally clear passwords, verification codes, and payment fields or require reconfirmation; that is a disclosed security boundary, not a preservation defect. User-generated content can have a different language from the interface and must not be translated or replaced automatically. A language switch cannot elevate authentication, authorization, or regional content access.

Applying it

• Map localized paths through stable route IDs. Maintain versioned migration allowlists for query, hash, filters, pagination, scroll, and form fields; never copy unknown parameters or arbitrary return URLs.
• Keep safely recoverable form content in component state or a protected server-side draft and rerender labels and errors after switching. Never serialize passwords, verification codes, payment data, or one-time credentials into URLs, generic migration payloads, persistent drafts, or cross-origin transfer. Clear them at boundaries such as navigation, reauthentication, a payment-provider change, or a security-context change; apply the threat model to in-memory state inside the same trusted component. Never replay a non-idempotent request automatically.
• Preserve a valid authenticated session, but rerun object-level authorization, gates, and content-availability checks at the destination. Label fallback language and provide a return path when translation is missing instead of silently degrading or going home.
• Switch midway through every core journey in end-to-end tests, asserting route, allowed state, focus, and task result. Add forged query, expired session, revoked permission, bundle failure, and duplicate-submission cases, and tell users which state was deliberately cleared.

Related

• Same group: S4.01.1 Automatic language detection must be overrideable · S4.01.2 The language switcher must be reachable before sign-in · S4.01.3 Display language names in their own language
• Adjacent: H3.09.1 Restore unsubmitted content after an unexpected interruption · S4.02.3 Interface language and content language can differ
• Search terms: state-preserving locale switch · localized route mapping · safe form-state migration