View Issue Detail

ID	Project	Category	Submitted / Last Updated
01367	UserSpice	Triage	2021-10-18 23:56:07 / 2021-10-19 22:37:38
Reported	James Erikson	Assigned To	Unassigned
Priority	none	Reported	5.3.5
Status	closed	Resolution Version and Commit
Summary	autocomplete="off" should be changed on all userspice inputs
Description	Unfortunately it still autocompletes on Chrome browsers. The fix is to use: autocomplete="new-password"

November 2021

I have had issues with password managers still autofilling this because they think it's a password.
November 2021

Turning off autocomplete in forms is done, by standard, by doing autocomplete="off". This isn't a change we would be able to move forward with, especially since password managers expect us to use "off". See: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
November 2021

On the same link you gave me it literally says what I said will work. Here's a link to that page that will take you down to where it's says what I did: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password
November 2021

I've tested it and it always works compared to the "off" method
November 2021

It also says that modern browsers don't support autocomplete=off in this section: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields
November 2021

Your ticket specifically says "autocomplete="off" should be changed on all userspice inputs", the section which hints towards this modified adjustment to the autocomplete is for user management pages, not for "all" of our inputs. Password Managers know what the "new-password" is, like Dan said, and use it to fill in a new password. There is no standard for complying with the "new-password" autocomplete value, browsers just normally don't fill it, and suggest a password for that field, and password managers target them. This isn't a reasonable or valuable change.