1237596 - autocomplete=off is being ignored by browsers

Status: RESOLVED WONTFIX

(Bugzilla :: Bugzilla-General, defect)

Description

[bjoern]

Attachment: 0001-really-disable-autocomplete-for-modern-browsers.patch

User Agent: Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 2015121300

Steps to reproduce:

I noticed that Firefox and Chrome autocomplete username/password at places where it is not wanted and where bugzilla already uses autocomplete="off". For example in editparams.cgi?section=mta it fills in smtp_username/smtp_password which might end up bad if the admin doesn't realize that.

Theses days it is more tricky to disable autocomplete. The most simple and reliable way seems to be to make the attribute readonly and "remove" the readonly via "onfocus".

Patch attached.

Comment 1

[Teemu Mannermaa (:wicked)]

Ewww, looks like an awful hack. Why do browsers break autocomplete=off? Shouldn't they be fixed instead of adding hacks to all webapps? :(

Comment 2

[bjoern]

yes, browsers started to ignore it, because some sites use autocomplete=off and then users started using insecure passwords. That's mainly speculation though. Better ask you colleagues who work on Firefox about it to be sure :-)

This is the least ugly and least intrusive hack I can find to fix autocomplete=off again.

Comment 3

[bjoern]

background info: https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100

Comment 4

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8705114 [details] [diff] [review]
0001-really-disable-autocomplete-for-modern-browsers.patch

Review of attachment 8705114 [details] [diff] [review]:
-----------------------------------------------------------------

I don't think fighting this browser feature is worthwhile.