1662192 - Missing login autocomplete popup on multi-page login form on tangerine.ca

Status: VERIFIED FIXED

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[Zeid Zabaneh [:zeid]]

Steps to reproduce: Save a password for a website, say https://example.com. Try to log in at https://www.example.com.

Expected behaviour: I should be able to select a username and a saved password should be available to me.

Actual behaviour: A username is not available for selection, however once I enter my username, if I navigate via context menu to Fill Password -> View Saved Logins and then go back to the web page, I can see all my saved passwords for this site.

Comment 1

[Bianca Danforth [:bdanforth]]

I just tried to reproduce this with https://facebook.com and trying to log in to https://www.facebook.com, and I found that the login showed upon clicking the username field, but it did not show up when right clicking the field and opening the context menu.

Do you use the Primary Password feature?

Comment 2

[Zeid Zabaneh [:zeid]]

I feel a little silly -- as trying to reproduce it now, I'm discovering that my initial behaviour to "fix" this was purely a correlation and not causation, so is the fact that the password is saved without a "www". Below are new steps to reproduce. It is potentially an edge case, but the behaviour is unexpected.

Note that the site I am logging into is a banking site that uses a "wizard" to log you in, appears to be running Angular. I.e. the first screen asks for a username, and the second asks for your password. The password input field is autofocused on the second screen. It is actually a "secret question" field but has type=password and behaves as a password field normally. The dropdown with saved passwords does not appear until I click outside the input field and then back into the input field. Clicking into the field, even though it is in focus already, does not show any passwords until I blur and re-focus.

So it appears there's an even listener that isn't being triggered when the page loads and focuses on the password field? Below is the input field in question, although not 100% certain if there's additional Javascript that is causing the focus. I removed some angular-specific attributes that seemed irrelevant:

<input name="securityQuestion" id="login_secretQuestion" ... type="password" maxlength="40" placeholder="" autocapitalize="none" autocomplete="off" autofocus="" autofocus-device="ALL" required="required" aria-invalid="true" style="">

I can try and create a simple HTML page to see if I can reproduce this that way.

Comment 3

[Sam Foster [:sfoster] (he/him)]

(In reply to Zeid Zabaneh [:zeid] from comment #2)

I can try and create a simple HTML page to see if I can reproduce this that way.

It would be helpful if you could copy the outerHTML of the form (it might need cleaning of personal/identifiable info) and attach here.
Also, if you can share the bank's domain name and/or form URL - even if its one we can't access without an account. This sounds something we may want to track as a site compatibility issue. That will let me update the bug title.

Comment 4

[Sam Foster [:sfoster] (he/him)]

We are interested in understanding what is going on here. Its possible the page is swapping out elements as it loads and as you focus, but to confirm that we would really need to see the site itself, or a comparable test case that has the same script interactions with the form.

Let me know if you have some time to chat and figure out a way to investigate further.

Comment 5

[Sam Foster [:sfoster] (he/him)]

The site in question is tangerine.ca. I can put a bogus user name in the login form but the next screen I get asks me to enter a PIN into a password field - so this is not the same flow as described in comment #2. Its not its going to be possible to diagnose without account details, or a functionally-similar-enough test case.

I think until we get more similar reports, or have more to go on, I going to file this into the the site compatibility bucket.

One more thing: the initial screen of the login flow on this site only has the username / customer-id field in the form. As there is no type=password field at all, we don't autofill any matching saved login, nor offer the autocomplete menu of saved logins.

:zeid, I'll clear this need-info for now as we have enough to triage the bug, but any more (public-facing-appropriate) detail you can add would still be valuable.

Comment 6

[Zeid Zabaneh [:zeid]]

Thanks :sfoster -- a username that would trigger the workflow in question is johnsmith (not my username) - but can be used to reproduce. The first issue (no username to select) obviously affects this workflow regardless of which username you use or save.

The issue affecting the matching saved logins for usernames obviously likely affects other sites since tangerine.ca is not the only site that uses a wizard-type workflow for logging in. The second issue is most likely specific to tangerine.ca

Comment 7

[Zeid Zabaneh [:zeid]]

FWIW, I've also been able to replicate the missing autocomplete popup on workforcenow.adp.com. Their new UI shows a user input field without a password field, until you enter a username.

This appears to be site-specific and related to whether a password field exists (but is hidden) or not. For example, appleid.apple.com has the same visual behaviour but has a hidden password field and works as expected.

Comment 8

[Matthew N. [:MattN]]

Bug 348941 is the meta bug to handle username and password fields on separate pages.

Comment 9

[Dimi Lee [:dimi]]

This should be fixed by Bug 1708455

Comment 10

[Timea Cernea [:tbabos][inactive]]

Marking this as verified-fixed. Saved bogus credentials via about:logins with username johnsmith and I can confirm it was indeed autofilled or available for selection in the autocomplete dropdown for the username field.
Please note that I was not able to check the full flow as it requires a security question answer before proceeding to the password field, for which I don't have the answer.