1119035 - (formless-logins) [meta] Support capturing and filling login credentials on web pages that don't use <form> elements or trigger submit events

Status: NEW

(Toolkit :: Password Manager, defect)

Description

[Chris Karlof [:ckarlof]]

Some sites (e.g., http://www.hulu.com/) don't use a <form> element in its login experience. The existing password manager code can't capture and fill the user's username and password unless the login page uses a <form> element. This is a breakdown bug for the password manager to support such sites.

Comment 1

[Justin Dolske [:Dolske]]

This could be split into two parts, although they're a bit intertwined. Filling an already-saved login into a page without a <form> (just a password and username field) should be fairly straightforward to do. But saving the login is harder, because there's no formsubmit event to trigger it. But this is also a general problem we want to solve, since this can happen even when there's a form (eg <img src=login.jpg oncick="doLogin()">)

Comment 2

[Chris Karlof [:ckarlof]]

The heuristic of

1) we have captured login data and the visibility of the password field went from visible -> not visible, or
2) we have captured some login data and a new page load happened

to trigger the showing of the capture dialog has worked for me in the past. This heuristic requires that we capture user input as the user enters it, rather than wait for a specific event (e.g., onsubmit). 

It's not perfect, of course, but nothing is. It can get challenging when dealing with change password pages, because sometimes those pages always show a password field. 

I, of course, generally encourage more creative thinking about this.

Comment 3

[Chris Karlof [:ckarlof]]

> This heuristic requires that we capture user input as the user enters it, rather than wait for a specific event (e.g., onsubmit). 

For related discussion of this idea, see https://bugzilla.mozilla.org/show_bug.cgi?id=1119077#c1

Comment 5

[Matthew N. [:MattN]]

Removing the priority from a meta bug.