9
var inputs = document.getElementsByTagName('input');
for (var i = 0; i < inputs.length; i++) {
    inputs[i].onfocus = foo;
}
function foo(){
    alert(this.value);
}

When the input values are manually entered:
Above code works and alerts the correct values regardless of the type of an input field.

When the input values auto-filled by browser:
Code works and alerts the correct values when the input field is of type text. In case of a password field, it alerts empty string!

Is this behaviour because of the browser's security policies? Or there's any workaround possible? I tried it in Chrome browser.

Akhil Dixit
  • 125
  • 1
  • 2
  • 8
  • Please clarify: are you having trouble accessing the "value" attribute that has been pre-populated by the page you have served, or are you talking about how Chrome pre-fills inputs with its password manager? If the latter, please see my answer. – CzechErface Feb 19 '16 at 08:07
  • If the 'value' attribute is pre-populated, there's no issue. The problem is when browser auto-fills the input boxes with its password manager (when you say save password for this site). In this case, if browser does not insert a value attribute to the DOM element, then what does it essentially do? Thanks for your answer Czech, and it seems there's no way I solve this! – Akhil Dixit Feb 19 '16 at 08:31

2 Answers2

2
$(document).ready(function() {
  $("input")
      .blur(password)
      .trigger('blur');
});

function password() {
   alert($(this).val())
}

DEMO

Rino Raj
  • 6,264
  • 2
  • 27
  • 42
  • 1
    No need for jQuery here: https://jsfiddle.net/7hn3ojcw/3/ I think @CzechErface is on the money anyway. I don't think accessing an input the user has populated (like in your example) is the issue, but an input the browser has pre-populated. – ste2425 Feb 19 '16 at 08:21
  • 1
    @ste2425 Actually it works with pre-populated pwd fields as well, just tested with both Chrome default password filler and lastpass extension, both input values were easily accessed. – Arturas Tamulaitis Feb 19 '16 at 08:53
  • @ArturasTamulatis is that with the native or jQuery? Either way i take back my comment, i would edit it but its been over 5 min. – ste2425 Feb 19 '16 at 09:01
  • @ste2425 tested with native :) – Arturas Tamulaitis Feb 19 '16 at 09:31
2

This is an interesting question because I believe that you are referring to the side-effect of a security feature in Chrome.

Chrome (and probably other browsers) may not actually populate the DOM with the auto-filled password because a malicious programmer could write a JavaScript that attempts to steal auto-filled passwords from unsuspecting victims once a page loads.

You will most likely require that the user clicks a submit button before you can gain access to that information.

You might be able to force the form to submit and check the value right before the submit actually occurs. If that works, then you can just cancel the submission by returning false in "onsubmit" and you now have the password.

Sunil Garg
  • 14,608
  • 25
  • 132
  • 189
CzechErface
  • 326
  • 2
  • 12
  • Submitting forms using JS is not a security issue too? – florin.prisecariu Feb 19 '16 at 08:43
  • I attempted to replicate the behavior that Akhil Dixit is experiencing to no avail. I am able to read auto-filled passwords from the DOM with both jQuery and mere JavaScript. I was just attempting to offer a possible reason for the inconsistency between our two browsers (I also use Chrome). – CzechErface Feb 19 '16 at 09:01