Member Avatar for pojke

Hi.

I got a problem and want to find a solution backwards :cheesy:
How to tell browser not to offer saving password in "password" form?
I know it is possible (p.e. internet banks using it), but dont know even where to search?

Reason why im searching:
I got it in my system at work (based on php, perl, js htm etc... ), but there is one place, where it should offer to save a password. I want to change it, but dont know even what language search? I suppose 80% its JS, but JS files loaded to this project have over 10 000 lines, so searching think i dont know will take a loooooong time... :confused:


pls help

  • 2 Contributors
  • 2 Replies
  • 103 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by pojke

Dani AI

Generated

Nice troubleshooting by and the quick pointer from — the behavior you found (JS moving/clearing the visible password field before submit) is a common trick that defeats browser heuristics for offering to save credentials. That approach is brittle: it breaks password managers, blocks password generation/autofill, harms accessibility, and can introduce accidental security issues when scripts touch credential data.

Browsers and password managers use a mix of form structure and field hints defined by the HTML spec to detect login fields, so changing the DOM at submit time can hide credentials from them. The correct, standards-based way to signal intent is to use the HTML autofill hints (tokens for current vs. new passwords) described in the spec and on MDN — rely on those instead of hacks. See the living HTML spec on autofill and the MDN reference for form autocomplete for details and tokens to use.

To locate the offending code in a large codebase without blind grepping, use the browser debugger: set DOM/event-listener breakpoints on the form or password input (break on attribute/subtree changes or on submit handlers) so execution will pause when JS touches the password value. A quick console check to enumerate password fields is useful:

document.querySelectorAll('input[type="password"]')

You can also attach a temporary submit breakpoint in the console to catch the submit handler:

document.querySelectorAll('form').forEach(f => f.addEventListener('submit', () => { debugger; }, true));

If there is a legitimate reason to prevent saving (very rare), redesign the flow — use one-time tokens, short-lived sessions, or separate transactional authentication rather than trying to hide the password field. In almost all cases the best practice is to follow the spec and let users’ password managers do their job.

References: MDN — autocomplete attribute, HTML Living Standard — Autofill.

Recommended Answers

All 2 Replies

Member Avatar for stymiee

Just view the source: autocomplete="off"

Member Avatar for pojke

It wasnt autocomplete. Ive found it.
For users, who would like to use it ill explain.

In form there was password input and one hidden input. Form had onsubmit JS code, which was copying password to hidden input and emptying password input. So browser though that password field is empty and doesnt offer saving password. Smart ;)

BTW when i was searching, i found in google sth like "autocomplete" but first of all its not a standard of html, second not every browser will "eat" it, so better do not use it.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.