1653547 - Username fields get empty login autocomplete rather than form history if another subdomain has a saved login

Status: NEW

(Toolkit :: Password Manager, defect, P2)

Description

Attachment: behavior.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Firefox 68 remembered multiple entries to form fields (i.e. name, id, etc.), when
"remember search an form history" is enabled and
"Autofill logins and passwords" is enabled, but current website is set as an exception

meaning: username for a website is remembered (probably in local cache), but don't want the password saved in Firefoxes database.

MattN addition: have a login saved for a different subdomain of this domain.

Actual results:

newer Firefox (70+) only remembers form fields (user+password combinations) that are saved in the password database (=lockwise)

Expected results:

Firefox 70+ should behave like before, remembering entries to form fields, even if they are not saved to lockwise

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Bianca Danforth [:bdanforth]]

Hm, yeah that seem like it could be a bug. Would you be comfortable doing a mozregression to help us identify at what specific point this behavior regressed?

Comment 3

[Bianca Danforth [:bdanforth]]

Timea, would you be able to run a mozregression on this issue?

Comment 4

[Timea Cernea [:tbabos][inactive]]

Just started checking back in FX68 as well as latest Release but I can't reproduce this on facebook.com. Form history for the username field is displayed even if the site is set up for exceptions for autofill logins and that should be expected given form history has nothing to do with Lockwise.
Hi sicher.nicht, could you share the site you are experiencing this issue with? Or it is global and it happens everywhere?

It would be worth trying this out in safe mode (https://goo.gl/AR5o9d) or even with a clean profile (https://goo.gl/AWo6h8) so we get addons and custom settings out of the possible reasons why this happens.

Side note: Strongly believe this has something to do with some settings or addons, maybe even Site Compat, since 6 days ago there was a report about how to delete Form History, see Bug 1655234 for reference. So it definitely works but something goes wrong here.

Comment 5

[Timea Cernea [:tbabos][inactive]]

Hey Bianca, since you added the affected/unaffected flags, can you also reproduce this? I'm afraid not to miss something important.

Comment 6

[Bianca Danforth [:bdanforth]]

Hi Timea; thanks for attempting this. I also was not able to reproduce the issue after trying the steps below[1].

Given step 5, perhaps the issue is that "Enter" was used to add the site to the blocklist, which unfortunately did not work in 68? sicher.nicht: Does removing the site from the exceptions list and re-adding it by clicking the "Block" button fix it? If not, can you try what Timea suggested regarding Safe Mode and a clean profile?

---

[1]: Here are the steps I took, though I was not able to reproduce:

1. Open with a new profile Firefox Release 68 (e.g. from https://archive.mozilla.org/pub/firefox/releases/)
2. Go to about:preferences in the URL bar.
3. In the search field in the page, enter "logins" to bring up the "Logins and Passwords" section of Preferences
4. In that section, click "Exceptions"
5. Add a site to the exceptions list (e.g. www.facebook.com).

• Note: Though Bug 1618899 landed in 80, it is still a bug in 68, so be sure to click the "Block" button, instead of hitting "Enter" to add the site; otherwise the site won't actually be blocked.

6. Click "Save Changes"
7. Go to the login page for the site added to the exceptions list (e.g. facebook.com)
8. Enter a phony username and password and submit the form
9. Go back to the site's login page (e.g. facebook.com)
10. Click the username field
11. Observe the Form History autocomplete popup for the username you just entered in step 8.
12. Repeat steps 1 through 11, but in step 1, use Firefox Nightly 81 instead of Firefox Release 68.

Comment 7

[sicher.nicht]

Hi guys!
As requested, I did a test to reproduce this, and found the problem:

If you have credentials for multiple subdomains, the mentioned problem occurs!
I.e. in my case:

• https://www.easybank.at (my main banking account) where I don't save any credentials.
• https://3dsecure.easybank.at (some subdomain for credit card management) where I do save a password.

In Firefox up to 68, with unsaved credentials, the usernames where still listed, but (obviously) without the passwords. Since Firefox 70 ONLY saved credentials are listed, and ALL other usernames are "forgotten".

Additionally:
I also recognize this on multiple severs I run myself, all being subdomains of my top domain. Here, since Firefox 70, Lockwise lists ALL the credentials for ALL the subdomains in ANY of the username/password prompts! But this - being another bug - I will report seperately.

Thanks,
best,
Martin

Comment 8

[Matthew N. [:MattN]]

(In reply to sicher.nicht from comment #7)

If you have credentials for multiple subdomains, the mentioned problem occurs!
I.e. in my case:

• https://www.easybank.at (my main banking account) where I don't save any credentials.
• https://3dsecure.easybank.at (some subdomain for credit card management) where I do save a password.

Nice find! Thanks! This is the same root cause as bug 1601375: bug 589628.

Am I correct in assuming that https://3dsecure.easybank.at only has a password saved, no username? (Asking because that would explain why you see no username in the dropdown of the username field)

Additionally:
I also recognize this on multiple severs I run myself, all being subdomains of my top domain. Here, since Firefox 70, Lockwise lists ALL the credentials for ALL the subdomains in ANY of the username/password prompts! But this - being another bug - I will report seperately.

That is filed as bug 1601558.

Comment 9

[sicher.nicht]

(In reply to Matthew N. [:MattN] from comment #8)

Am I correct in assuming that https://3dsecure.easybank.at only has a password saved, no username? (Asking because that would explain why you see no username in the dropdown of the username field)

Correct!

Comment 10

[Timea Cernea [:tbabos][inactive]]

Removig the [qa-regression-triage] whiteboard since we have the regression range.