1771372 - Saved Username is suggested for Password on Ester.ee

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[tomorrow]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0

Steps to reproduce:

Go to about:logins and create New Login with following details:
Website address: https://login.ester.ee/cas/auth?library=5&locale=en
Username: User
Password: Pass

Go to https://login.ester.ee/cas/auth?library=5&locale=en

Click on Username input field.

Actual results:

The saved Username is not suggested for Username input.
Username is suggested for Password input instead.

Expected results:

Firefox should automatically suggest Username for Username input and when selecting the offered Username the Password input should be automatically filled.

Comment 1

[Dimi Lee [:dimi]]

The sign-in form contains two password fields. The first password field is not visible and it's autocomplete attribute is "new-password". The second password field is the "real" password field. Since our heuristic always uses the first password field found [1][2], we don't locate the right username/password in this case.

[1] https://searchfox.org/mozilla-central/rev/32ca4fc265150e7d3d7aa6c6abea088768cf024b/toolkit/components/passwordmgr/LoginManagerChild.jsm#1621
[2] https://searchfox.org/mozilla-central/rev/32ca4fc265150e7d3d7aa6c6abea088768cf024b/toolkit/components/passwordmgr/LoginManagerChild.jsm#1700

Comment 2

[Sergey Galich [:serg]]

This is the same root cause as Bug 1548771, I'll take it

Update: this is a different issue

Comment 3

[Sergey Galich [:serg]]

:tomorrow thank you for sharing this bug with us!

As :dimi discovered there are more fields than user can see. Pressing Shift+Tab from username field actually focuses "invisible" password field and pressing Shift+Tab again focuses "invisible" username field. However web site does not hide these fields, it places them into a box with 1x1 size, so they are invisible to human, but visible to the computer. All password fields are located within the same form. Same behavior on Chromium.

Comment 4

[tomorrow]

Understood. Am i correct when i assume that fixing Bug 1548771 wont fix this?
I should contact the website developer instead to resolve the issue as it is not browser specific?

Comment 5

[Sergey Galich [:serg]]

(In reply to tomorrow from comment #4)

Understood. Am i correct when i assume that fixing Bug 1548771 wont fix this?
I should contact the website developer instead to resolve the issue as it is not browser specific?

Yes, unfortunately this is different problem from Bug 1548771.

If you can, please contact web site developer and ask them to hide "invisible" fields (display:none for example) and perhaps use 2 <form> elements for different flows. Feel free to share this bug report, we can answer questions they might have.

Comment 6

[tomorrow]

Thank you. I sent them an email with a link to this bug. We'll see when and if they respond.