Why does Firefox relate saved passwords to form fields with different names?

3

I have a web page that uses cookies to track logins. I present a login for it like this:

<FORM ACTION="/authenticate" METHOD="post">
<TABLE BORDER="0" ALIGN="center">
<TR>
  <TD VALIGN="top" ALIGN="right">
    <FONT SIZE="2">Login:&nbsp;</FONT>
  </TD> <TD VALIGN="top" ALIGN="left" >
    <INPUT TYPE="text" NAME="login" SIZE="24" VALUE="" >
  </TD>
</TR>
<TR>
  <TD VALIGN="top" ALIGN="right"><FONT SIZE="2">Password:&nbsp;</FONT></TD>
  <TD ALIGN="left" >
    <INPUT TYPE="password" NAME="password" SIZE="24" VALUE="">
  </TD>
</TR>
</TABLE>   
<P>
<DIV ALIGN="center"><INPUT TYPE="SUBMIT" VALUE="Continue"></DIV>
</FORM>

This works fine and I can use Firefox to save my login password. Within the application I allow person records to be modified including their login and password. Within that form I present something like this:

<TR>
  <TD VALIGN="top" ALIGN="right">
    <FONT SIZE="2">Login<BR>(Optional):&nbsp;</FONT>
  </TD> <TD VALIGN="top" ALIGN="left" >
<INPUT TYPE="text" NAME="person_login" SIZE="8" VALUE="">
  </TD>
</TR>
<TR>
  <TD VALIGN="top" ALIGN="right">
    <FONT SIZE="2">Password:&nbsp;</FONT></TD>
  <TD ALIGN="left" >
    <INPUT TYPE="password" NAME="person_pass" SIZE="8" VALUE="">
  </TD>
</TR>

Even though it uses different names, Firefox displays my own login and stars for the password. However, if the person_login has a value other than blank it seems to do the correct thing. Is this a Firefox thing? Can I do something in HTML to fix this?

D'Arcy

Posted 2012-06-19T17:08:24.387

Reputation: 91

I can't reproduce this on Firefox 12 (updating as we speak). Which version are you using? – Dennis – 2012-06-19T17:44:28.493

i'm not that experienced with these things so could be getting the wrong end of the stick here but you seem pretty clear and I think i've got you.. if you are referring to the same problem of autocorrect or autosuggest, the filling in of forms wuth some username/password without any sense. Like, you use a username/password on one site, then the browser stupidly uses it on another site. It just remembers the form info and does it automatically with no sense, that may be what's happening, what you refer to. If so, there is autosuggest=off though it's not standard – barlop – 2012-06-19T17:49:13.180

here is a link about autosuggest=off , I don't know if it's relevant to you http://stackoverflow.com/questions/582244/is-there-a-w3c-valid-way-to-disable-autocomplete-in-a-html-form But autosuggest=off is a pain too as it means no filling in at all. You want a smart auto filling in feature.

– barlop – 2012-06-19T17:49:29.263

@barlop: It's autocomplete, and it shouldn't have any impact when saving passwords. – Dennis – 2012-06-19T17:50:35.920

@Dennis ah, autosuggest is start..run in xp. Does html autocomplete only affect usernames then? It may not stop them getting saved but it would stop them getting loaded in, and his issue is with them getting loaded in – barlop – 2012-06-19T17:53:27.497

@barlop: Autocomplete in non-standard, but no mayor browser uses it for <input type="password"> fields. Furthermore, autocomplete takes action after you start typing. It can't preload username and password, since there are usually multiple choices. – Dennis – 2012-06-19T17:55:44.097

@D'Arcy: I couldn't reproduce on FF 13 (Win 7) either. – Dennis – 2012-06-19T17:57:57.067

let us continue this discussion in chat

– barlop – 2012-06-19T18:08:47.663

Dennis - Firefox 13 on Xubuntu. – D'Arcy – 2012-06-19T18:11:25.200

barlop - I understand but in this case they aren't even the same field names. Login uses login/password and the edit screen users person_login/person_password. – D'Arcy – 2012-06-19T18:12:34.853

I finally logged into the chat but it won't let me talk since I have no reputation here. – D'Arcy – 2012-06-19T18:26:06.847

The same thing just happened in a brand new installation of Chrome. – D'Arcy – 2012-06-19T18:33:36.203

@D'Arcy there's a site for programming questions called stackoverflow. they might take HTML . You could title the question to make it more generic. With HTML forms how do I stop browsers saving the same password to form fields of different names? – barlop – 2012-06-20T07:44:19.997

Answers

1

I believe that I have solved the problem. If I set the autocomplete attribute on the password field in the user edit form it seems to work. Strangely it fixes the login field as well even though I don't change that one. Also, you would think that clearing recent history after logging in would have the same effect but it does not. Telling the browser to forget the password does work though. Something doesn't seem consistent here.

D'Arcy

Posted 2012-06-19T17:08:24.387

Reputation: 91