autocomplete = 'off' is not working on firefox

Question

I created 2 login pages of same domain.

1. www.example.com/login.cfm
2. www.example.com/newLogin.cfm

I put the form name different for 2 forms with in these two page. Also I put autocomplete = 'off' for the second form and for the text fields within that form.(But it is on for first form ).

Now if I save the username and password at the time of login from www.testDomain.com/login.cfm in browser, then the list of usernames are auto populating in the username field of second login page even if the auto Complete is off. I need to block this for security reasons. Is there any way to do this? I am using FireFox V21.

Answer 1

This is the cleanest solution I have found to keep Firefox from auto completing.

 <!-- The text and password here are to prevent FF from auto filling my login credentials because it ignores autocomplete="off"-->
 <input type="text" style="display:none">
 <input type="password" style="display:none">

Add this code snip-it above your input of type password.

As far as I can tell Firefox is looking for an input of type Password, and filling in the password and then adding the username to the input of type text above it. Without a name or an id the inputs don't get added to the post, but this is still a hack.

Answer 2

$("#CVV").on("focusout", function() {
    if ($(this).val() == "") {  
      $(this).attr("type", "text");
    }   
});

<input type="text" name="username" class="input" ID="CVV" onfocus="removeErr('CVV'); $(this).attr('type', 'password');">

Answer 3

You all should try this attribute :

<input type="password" autocomplete="new-password" />

If you are defining a user management page where a user can specify a new password for another person, and therefore you want to prevent autofilling of password fields, you can use autocomplete="new-password".

See the documentation there : https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#Preventing_autofilling_with_autocompletenew-password

Answer 4

Firefox version 61 this seems to be enough to disable autocomplete in forms:

<input type="password" hidden />

All inputs after this one at the top of the form are ignored.

Answer 5

Nothing worked for me for the password field so I'll share my trick

<input name="password" type="text" onkeydown="this.type='password'">

I believe it is still secure and works on Chrome, Firefox, other

Answer 6

I was encountered this issue for a long time. Firefox was kept input values even page reload. Setting autocomplete attribute to off did not solve.

Form caching is a really useful mechanism for the user experience. But, in the small percentage of use-cases like translating values of textboxes or texareas to other language, these gave me headache.

To resolve this, just simply reset the form after page was loaded as

 $('form').trigger("reset");

Answer 7

I've noticed this behavior also lately - Firefox only; there's seems to be a problem with the 'autocomplete="off"' attribute.

Used to work great up until a month ago - and broke up around the time Firefox version 30.0 was released.

Still works great on Chrome + IE;

Answer 8

https://bugzilla.mozilla.org/show_bug.cgi?id=956906

http://lists.w3.org/Archives/Public/public-webapps/2014JanMar/0015.html

Autocomplete has been disabled for password type input fields. The above links mention that respectively for FireFox and IE, but I see that setting autocomplete to off for form too is not working.

Answer 9

This is working for me:

<input type="text" name="username" value=" " onclick="if(this.value == ' ') this.value=''" >

Click here for more info about this.

Answer 10

Try this :
<input type="password" style="display:none">
<input type="password" name="password">

Type must be the same. The hidden password will be fill instead of real password input.

If it's a new password (or reseted) use autocomplete="new-password" instead of autocomplete="off".

Hope it helps.

Answer 11

I tried all of the above with Firefox 52 and nothing worked. I did get it to work with jQuery though and replacing the value with the original value, or:

jQuery(window).load( function () {
    email = jQuery('#auth_user_email');
    email.prop('value', email.attr('value'));
});

where in jQuery the prop is the current value in the document and attr is the original when the document is first retrieved/loaded. I used the load function because it runs after the ready function and I believe definitely after the autocomplete overwrites the input value. you can do the same thing with the password input also.

Answer 12

A way to Firefox don't find those fields is to change their type to hidden before the post.

You can use a jQuery or JavaScript to set that on onclientclick in your submit button.

Example: <script type="text/javascript"> function setHidden() { $('.input').prop('type', 'hidden'); } </script>

<input type="text" name="username" class="input">
<input type="password" name="password" class="input" >
<asp:Button ID="ubtnLogin" Text='OK' runat="server" OnClick="btnLogin_Click" OnClientClick='setHidden();' />

Just remember to clear your browser's cache before testing or use the private mode (CTRL+SHIFT+P).

Answer 13

thanks to the idea of albert.garipov, i made a solution that mimics the functionality of the type password. this doesn't show the password on input

<input type="text" id="password" onkeyup="OnChangePassword()">

---

function OnChangePassword()
{ 
  if ($("#password").val() == "") {
      $("#password").attr('type', 'text');
  }
  if ($("#password").val() != "") {
      $("#password").attr('type', 'password');
  }
}

Answer 14

Just put a random value in autocomplete.

Disregard my old suggestion as it is not a good practice.

Answer 15

I know quite an old question. But adding autocomplete="off" in the form tag might help

works for firefox now* (*98.0.2 (64-bit))

Answer 16

This behavior of ignoring autocomplete on login fields was introduced intentionally.

According to this article on MDN:

You can use the autocomplete attribute value of new-password to inform the browser not to fill the password field in your sign up form. This also provides a hint to let the browser suggest generating a strong password.

<form>
  <input type="text" name="username" placeholder="enter your username" autocomplete="username">
  <input type="password" name="password" placeholder="enter your password" autocomplete="password">
  <button> Sign In </button>
</form>

<form>
  <input type="text" name="username" placeholder="create a username" autocomplete="username">
  <input type="password" name="password" placeholder="create a password" autocomplete="new-password">
  <button> Sign Up </button>
</form>

There is no equivalent autocomplete value for new username fields. Firefox heuristically determines what should be classified as a username and whether it should be autofilled or not. The input[name=username] near the new-password field should be detected automatically and ignored.

Answer 17

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

If a browser keeps on making suggestions even after setting autocomplete to off, then you have to change the name attribute of the input element.

change the name attribute

<input type="text" name="user_name" class="input" autocomplete="off">
<input type="password" name="pass_word" class="input" autocomplete="off">

Answer 18

I realize that this is an old question, but as it's still relevant on Google searches, I believe it's important to present another view which opposes a lot of the answers here which, while well intentioned, are somewhat short-sighted.

Preventing auto-fill for login inputs can lead to a lot of problems. There are no benefits and significant downsides. Humans are bad at remembering credentials, leading to people without password managers using the same passwords on multiple (often critical) sites. If one of these sites is compromised, there's a very good chance that an attacker can log into other sites with the same credentials. Tools like LastPass, Bitwarden, Dashlane, Onepassword, etc. all exist for a good reason: they help keep the web a safer place for the majority of users by facilitating the use of separate passwords per web site.

Mozilla, Google and Microsoft are all on-board with this and have purposely decided to ignore the autocomplete="off" directive in many cases where it is likely to be more beneficial, in the long run. For further details about this, I'd recommend taking a look at the following articles from Mozilla, Google/Chromium, Microsoft and the Web Hypertext Application Technology Working Group:

• https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
• https://bugs.chromium.org/p/chromium/issues/detail?id=468153
• https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/9847360/
• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill

Now, there may be cases where you're writing an internal application in an industry with strict compliance requirements. It might seem like a good idea to disable auto-fill for login forms in this environment given the added potential for sharing passwords if left alone. My answer to that would be that this is out of scope for the front-end web developer, and should fall to the desktop experience and the IT operations teams.

There are many ways that IT departments can enforce controls on workstations to prevent automated password sharing. Group Policy, SCCM, least-privilege account provisioning, etc. are all just the tip of the iceberg, and they've far more robust than attempting to tell the user-agent to disable autocomplete when it's not designed to function that way.

tl;dr: Please take the time to understand the platform you're developing for and don't work around the specs to disable autocomplete.

Answer 19

Use autocomplete="off" tag at the end of your input tag:

For ex.

<input type="text" name="username" autocomplete="off" />

Answer 20

Add autocomplete="off" to your form tag, as documented in the Mozilla document

Check the following link for more information

How to Turn Off the Autocompletion Feature