How does a website prevent the pasting of a password or email address?

Question

I've noticed some sites will prevent users from pasting data - anything from passwords to usernames/emails to everything. Without discussing the practice and rational/reasons for/against it, what is the technical means by which a website prevents me from pasting data into a text entry field?

For example, this site does not allow pasting into the "Retype Email Address" field. How? It's my guess that there are various ways to implement this behavior?

I'm using Firefox 62.0.2 on OS X 10.11.6.

Answer 1

Answer: JavaScript

Look at the source code of the page you link to.

<input type="text" size="30" maxlength="99" onkeydown="clearErrMsg(event)" onblur="validateEmail(false)" onpaste="SFDOMEvent.preventDefault(event);"
               id="fbclc_emailConf"
               name="fbclc_emailConf"
               value="" aria-required="true">

It has SFDOMEvent.preventDefault(event); bound to the onpaste event of the input element. preventDefault will abort the action being taken by preventing the default behaviour - the paste. Other sites will use variations of this.

Answer 2

It is very simple to disable copy, cut or paste into an HTML field :

Example that disables everything :

<input type="text" onselectstart="return false" onpaste="return false;" onCopy="return false" onCut="return false" onDrag="return false" onDrop="return false" autocomplete=off/>

For more information see Prevent Copy, Cut and Paste into HTML Input Text Fields.