1576142 - When adding autocomplete="new-password" firefox prompts to save a password

Status: VERIFIED INCOMPLETE

(Toolkit :: Password Manager, defect)

Description

[Simon Sheppard]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

When adding autocomplete="new-password" to a form field that uses onClick to run some javascript the result is that Firefox offers to save the password, and will save the password and populate the field even though this is not the behaviour documented here: (https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#Preventing_autofilling_with_autocompletenew-password)

Actual results:

Firefox ignores the Autocomplete setting.
The response to bug https://bugzilla.mozilla.org/show_bug.cgi?id=1575996
states "The user should be in control of whether they want to save a password, not the website, so we will not provide a way for website to prevent a prompt to save. ***The attribute only prevents autofill of a saved login.***"
But that last part is not working.

Expected results:

The autocomplete="new-password" should behave as it does on other browsers, in that it should not auto fill a new password.
Steps to reproduce:

1. Load this page https://ss64.com/pass/
2. type in any password
3. press Generate
4. Press the SS64 button to go to https://ss64.com/
   The browser will then prompt to save a password and will offer to auto fill it when your return to the first page.
   n.b. this only happens when you navigate away from the page and only when navigating to another page on the same domain.
   Following the same steps in Google Chrome it all works as expected.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Matthew N. [:MattN]]

(In reply to Simon Sheppard from comment #0)

When adding autocomplete="new-password" to a form field that uses onClick to run some javascript the result is that Firefox offers to save the password, and will save the password and populate the field even though this is not the behaviour documented here: (https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#Preventing_autofilling_with_autocompletenew-password)

This behaviour actually doesn't contradict that text at all. The page is talking about automatically filling the field, not about autocomplete or about prompting to save.

Actual results:

Firefox ignores the Autocomplete setting.
The response to bug https://bugzilla.mozilla.org/show_bug.cgi?id=1575996
states "The user should be in control of whether they want to save a password, not the website, so we will not provide a way for website to prevent a prompt to save. ***The attribute only prevents autofill of a saved login.***"
But that last part is not working.

So is the summary of this bug incorrect since it seems to be about prompting to save just like bug 1575996 was?