This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 25879 - Given that Firefox[1], Chrome[2], and IE[3] have now disabled autocomplete=off for password fields, [...]
Summary: Given that Firefox[1], Chrome[2], and IE[3] have now disabled autocomplete=of...
Status: RESOLVED FIXED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-23 23:31 UTC by contributor
Modified: 2014-09-19 23:43 UTC (History)
6 users (show)

See Also:

Attachments

Description contributor 2014-05-23 23:31:44 UTC 
Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html
Multipage: http://www.whatwg.org/C#autofilling-form-controls:-the-autocomplete-attribute
Complete: http://www.whatwg.org/c#autofilling-form-controls:-the-autocomplete-attribute
Referrer: http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html

Comment:
Given that Firefox[1], Chrome[2], and IE[3] have now disabled autocomplete=off
for password fields, maybe we should update the spec with a more concrete
definition for autofill that explicitly mentions the password manager, and
accordingly remove references to password-type fields from this section.


 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=956906
 [2]:
http://www.theregister.co.uk/2014/04/09/chrome_makes_new_password_grab_in_vers
ion_34/
 [3]: http://stackoverflow.com/a/18242266/1198729

Posted from: 103.21.126.78
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
Comment 1 Manish Goregaokar 2014-05-23 23:32:34 UTC 
ccing self.
Comment 2 Ian 'Hixie' Hickson 2014-07-30 22:32:40 UTC 
Are we sure Chrome in particular has disabled this entirely? I still find that Chrome doesn't offer to save passwords sometimes unless I manually strip the autocomplete=off attributes using the DOM inspector.
Comment 3 Evan Stade 2014-07-30 22:44:22 UTC 
+gcasto to respond to Ian's comment.
Comment 4 Garrett Casto 2014-07-30 23:32:23 UTC 
autocomplete=off should have no affect on password fields at this point. If you know of cases where this isn't true, please forward them to me as it's a bug.

Note that you can get the old behavior by using a flag ('--do-not-ignore-autocomplete-off') in case you accidentally have that set somehow.
Comment 5 Ian 'Hixie' Hickson 2014-07-31 15:26:45 UTC 
Does autocomplete=off on <form>s or on the username field still block password saving?
Comment 6 Manish Goregaokar 2014-07-31 15:44:24 UTC 
(In reply to Ian 'Hixie' Hickson from comment #5)
> Does autocomplete=off on <form>s or on the username field still block
> password saving?

This is not the case for Firefox[1]. It doesn't seem to be the case for Chrome either, but I'm not sure.


 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=425145
Comment 7 Garrett Casto 2014-07-31 15:51:36 UTC 
It is not the case for Chrome either.
Comment 8 Ian 'Hixie' Hickson 2014-07-31 23:22:06 UTC 
So if there's a form with a username field, a password field, and some other field (say a two-factor-auth field), and all the fields and the form have autocomplete=off, Firefox and Chrome will remember the username and password, but not the other field?


I've definitely had Chrome not remember passwords on pages with autocomplete=off in the recent past. I didn't realise this was now a bug. I'll try to take note of it in the future and report it.
Comment 9 Ian 'Hixie' Hickson 2014-09-08 23:17:14 UTC 
I cannot get either Chrome to remember the passwords on this form:

   http://www.hixie.ch/tests/adhoc/html/forms/autocomplete/004.html

Firefox offers to, and does show them if you visit 004.html again. However, on 003.html which is identical except for having autocomplete=off, the password isn't prefilled. In Chrome, neither form saves the password and neither refills it.
Comment 10 Evan Stade 2014-09-08 23:22:35 UTC 
Chrome might require https?
Comment 11 Manish Goregaokar 2014-09-08 23:26:27 UTC 
I get the prompt when I try to log in to HTTP Wikipedia

http://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Pag
Comment 12 Manish Goregaokar 2014-09-08 23:28:55 UTC 
Adding autocomplete=false to the pwd field or the form on the Wikipedia page linked to above doesn't stop the prompt.
Comment 13 Evan Stade 2014-09-08 23:34:11 UTC 
http wikipedia redirects to https wikipedia (for me anyway)
Comment 14 Manish Goregaokar 2014-09-08 23:36:15 UTC 
it seems like if you open https wikipedia and then explicitly edit out the https for the page you're on, it doesn't redirect. *shrug*
Comment 15 Garrett Casto 2014-09-09 00:33:17 UTC 
Chrome assumes that if the same form (for a loose definition of same) is present after form submission, then submission failed and we shouldn't prompt the user to save the password. If you changed the submit to go to a different page, it will prompt to save.
Comment 16 Ian 'Hixie' Hickson 2014-09-19 20:49:37 UTC 
Aha, the issue in comment 15 is what was breaking my testing.
Comment 17 Ian 'Hixie' Hickson 2014-09-19 21:16:02 UTC 
How's this?
Comment 18 contributor 2014-09-19 21:16:30 UTC 
Checked in as WHATWG revision r8794.
Check-in comment: autofill: Encourage password saving.
https://html5.org/tools/web-apps-tracker?from=8793&to=8794
Comment 19 Ian 'Hixie' Hickson 2014-09-19 23:43:46 UTC 
Please reopen the bug if it's not perfect. Thanks!