25879 2014-05-23 23:31:44 +0000 Given that Firefox[1], Chrome[2], and IE[3] have now disabled autocomplete=off for password fields, [...] 2014-09-19 23:43:46 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED FIXED http://www.whatwg.org/specs/web-apps/current-work/#autofilling-form-controls:-the-autocomplete-attribute P3 normal Unsorted 1 contributor ian dbeam estade gcasto ian manishearth mike contributor oldest_to_newest 106750 0 contributor 2014-05-23 23:31:44 +0000 Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html Multipage: http://www.whatwg.org/C#autofilling-form-controls:-the-autocomplete-attribute Complete: http://www.whatwg.org/c#autofilling-form-controls:-the-autocomplete-attribute Referrer: http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html Comment: Given that Firefox[1], Chrome[2], and IE[3] have now disabled autocomplete=off for password fields, maybe we should update the spec with a more concrete definition for autofill that explicitly mentions the password manager, and accordingly remove references to password-type fields from this section. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 [2]: http://www.theregister.co.uk/2014/04/09/chrome_makes_new_password_grab_in_vers ion_34/ [3]: http://stackoverflow.com/a/18242266/1198729 Posted from: 103.21.126.78 User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36 106751 1 manishearth 2014-05-23 23:32:34 +0000 ccing self. 109618 2 ian 2014-07-30 22:32:40 +0000 Are we sure Chrome in particular has disabled this entirely? I still find that Chrome doesn't offer to save passwords sometimes unless I manually strip the autocomplete=off attributes using the DOM inspector. 109621 3 estade 2014-07-30 22:44:22 +0000 +gcasto to respond to Ian's comment. 109625 4 gcasto 2014-07-30 23:32:23 +0000 autocomplete=off should have no affect on password fields at this point. If you know of cases where this isn't true, please forward them to me as it's a bug. Note that you can get the old behavior by using a flag ('--do-not-ignore-autocomplete-off') in case you accidentally have that set somehow. 109669 5 ian 2014-07-31 15:26:45 +0000 Does autocomplete=off on <form>s or on the username field still block password saving? 109674 6 manishearth 2014-07-31 15:44:24 +0000 (In reply to Ian 'Hixie' Hickson from comment #5) > Does autocomplete=off on <form>s or on the username field still block > password saving? This is not the case for Firefox[1]. It doesn't seem to be the case for Chrome either, but I'm not sure. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=425145 109676 7 gcasto 2014-07-31 15:51:36 +0000 It is not the case for Chrome either. 109724 8 ian 2014-07-31 23:22:06 +0000 So if there's a form with a username field, a password field, and some other field (say a two-factor-auth field), and all the fields and the form have autocomplete=off, Firefox and Chrome will remember the username and password, but not the other field? I've definitely had Chrome not remember passwords on pages with autocomplete=off in the recent past. I didn't realise this was now a bug. I'll try to take note of it in the future and report it. 111212 9 ian 2014-09-08 23:17:14 +0000 I cannot get either Chrome to remember the passwords on this form: http://www.hixie.ch/tests/adhoc/html/forms/autocomplete/004.html Firefox offers to, and does show them if you visit 004.html again. However, on 003.html which is identical except for having autocomplete=off, the password isn't prefilled. In Chrome, neither form saves the password and neither refills it. 111213 10 estade 2014-09-08 23:22:35 +0000 Chrome might require https? 111214 11 manishearth 2014-09-08 23:26:27 +0000 I get the prompt when I try to log in to HTTP Wikipedia http://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Pag 111215 12 manishearth 2014-09-08 23:28:55 +0000 Adding autocomplete=false to the pwd field or the form on the Wikipedia page linked to above doesn't stop the prompt. 111217 13 estade 2014-09-08 23:34:11 +0000 http wikipedia redirects to https wikipedia (for me anyway) 111219 14 manishearth 2014-09-08 23:36:15 +0000 it seems like if you open https wikipedia and then explicitly edit out the https for the page you're on, it doesn't redirect. *shrug* 111227 15 gcasto 2014-09-09 00:33:17 +0000 Chrome assumes that if the same form (for a loose definition of same) is present after form submission, then submission failed and we shouldn't prompt the user to save the password. If you changed the submit to go to a different page, it will prompt to save. 111846 16 ian 2014-09-19 20:49:37 +0000 Aha, the issue in comment 15 is what was breaking my testing. 111847 17 ian 2014-09-19 21:16:02 +0000 How's this? 111848 18 contributor 2014-09-19 21:16:30 +0000 Checked in as WHATWG revision r8794. Check-in comment: autofill: Encourage password saving. https://html5.org/tools/web-apps-tracker?from=8793&to=8794 111865 19 ian 2014-09-19 23:43:46 +0000 Please reopen the bug if it's not perfect. Thanks!