1616528 - Save doorhanger is displayed on twitch.tv after toggling Show password

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect, P3)

Description

[Timea Cernea [:tbabos][inactive]]

Attachment: Recording of the issue

Affected platforms:
Windows 10 x64
MacOS 10.15

Affected versions:
All

Steps to reproduce:

1. Launch Firefox
2. Go to twitch.com and reach the login form
3. type anything in the password field and click on the "Show" toggle

Expected:
The password should be unmasked.

Actual:
The password is unmasked and the Save Doorhanger is displayed.

Regression-Range:
Not a regression, can reproduce back to FX68

Comment 1

[Matthew N. [:MattN]]

From the logs:

LoginManagerChild: notified before form submission LoginManagerChild.jsm:716:8

The issue is that Twitch is using a <button> with the default type of "submit" so it's triggering a form submission which I assume they later prevent with preventDefault():

<button class="tw-align-items-center tw-align-middle tw-border-bottom-left-radius-small tw-border-bottom-right-radius-small tw-border-top-left-radius-small tw-border-top-right-radius-small tw-button-icon tw-button-icon--secondary tw-button-icon--small tw-core-button tw-core-button--small tw-inline-flex tw-interactive tw-justify-content-center tw-overflow-hidden tw-relative" 
        tabindex="-1" 
        aria-label="Toggle password visibility">…</button>

We intentionally ignore the preventDefault and save anyways so that we can save when sites use XHR/fetch for login after a preventDefault() .

They could easily fix this by adding type=button to this element. I see no reason for this to be a submit button. Hopefully we can reach out to them to tell them this easy fix.

Comment 2

[Mike Taylor [:miketaylr]]

Adam, do you have any Twitch contacts we can pass this along to?

Comment 3

[Mike Taylor [:miketaylr]]

We actually have a mailing list... I just forgot :(

Comment 4

[Mike Taylor [:miketaylr]]

This no longer reproduces for me. Can you verify please Timea?

Comment 5

[Timea Cernea [:tbabos][inactive]]

Attachment: Nightly81 - Reproducible

Unfortunately, I can still reproduce this on latest Nightly 81 on Windows 10

Comment 6

[Mike Taylor [:miketaylr]]

Bummer, thanks for re-testing.

Comment 7

[Noah Manneschmidt]

We (Twitch) have finally found this in our backlog and updated the button in question to have the type="button" attribute which should finally resolve this.

Comment 8

[Raul Bucata]

I was not able to reproduce the issue. Revealing the password does not trigger the Save password and username doorhanger

Tested with:

Browser / Version: Firefox Release 100.0.2 (64-bit)/ Firefox Nightly 102.0a1 (2022-05-23) (64-bit)
Operating System: Mac OSX Catalina 10.15.7
Operating System: Ubuntu 20.4 LTS x64

Closing this as fixed.

https://prnt.sc/V0OiiKm_Qhze