Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

91–100 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#91

Post by Roritharr »

anoncake wrote: post #55
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are. You autocomplete=off a password field? That attribute won't have an effect on your site anymore. You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned. Scroll hijack…

This is actually a reasonable proposal. A moderate list could be an in-built feature, with some config options.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#92

Post by noselasd »

xg15 wrote: post #88
TekMol wrote: post #40

I guess this will lead to a horrible coding style where instead of having this in the form: We will see stuff like this: Where developers use some type of abstraction that generates a random id for each field and then assigns it to the original value server side or in javascript. Just like they already randomise asset filenames to avoid caching.

> Just like they already randomise asset filenames to avoid caching. But why? Isn't the whole point of caching to improve delivery if static assets? Did they run into staleness problems? Then why not use if-modified-since/if-none-match?

You are assuming browsers(there are many more than chrome&ff) ,proxies, etc. do caching correctly.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#93

Post by asdf-asdf-asdf »

title is wrong, the spec is not ignored. spec says: " When an element’s autofill field name is "off", the user agent should not remember the control’s data, and should not offer past values to the user. "

please note that it uses "should", not "must". these words have precise definition in specs, see RFC2119:

" SHOULD This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course. "

one may argue whether chrome has valid reasons or not, but saying they ignore it is incorrect.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#94

Post by Nitramp »

watwut wrote: post #82
carstenhag wrote: post #41

As I had already commented on the issue, it completely breaks Germany's main train ticket selling website: https://i.imgur.com/BjYTgSn.png They have tagged the field as autocomplete=off but Chrome just doesn't care. Also see this linked issue where they collected valid use cases for autocomplete=off. They just seem to ignore 452 use cases (I can't comment on the quality of them, I did not read any). https://bugs.chro…

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#95

Post by Reelin »

Carpetsmoker wrote: post #72
the_pwner224 wrote: post #5

Explanation from the 'rogue Chromium dev' is linked to in comment 19 of this bug: https://bugs.chromium.org/p/chromium/issues/detail?id=914451... https://bugs.chromium.org/p/chromium/issues/detail?id=468153...

> somewhere along the journey of the web autocomplete=off become a default for many form fields, without any real thought being given as to whether or not that was good for users And here I was, all along, thinking that website authors were in control of how their websites behaved. How silly of me!

It's complicated. Sometimes website authors do silly things that negatively impact users; browsers ought to help (without breaking things!) where possible.

Some daily annoyances that I wish browsers would actively mitigate, in no particular order: js-based redirects, blocking copy-paste, disabling text selection, hijacking the forward slash to open the website's own search function (I'm looking at you, Github), hijacking any of my other keyboard shortcuts that I rely on, creatively breaking my back and forward buttons (yes I realize there are legitimate reasons for some webapps), and overriding the built in right-click context menu.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#97

Post by xg15 »

Relevant reply from a Googler seems to be this: https://bugs.chromium.org/p/chromium/issues/detail?id=914451...

by battre@google.com

... which doesn't read at all to me like a "rogue dev" and more like a shared sentiment inside the Chrome team that autocomplete=off should be ignored.

At least, if there is a direct spec violation that breaks all kinds of applications and the answer your hear is "oh well, we're working on giving the user more options and improving our algorithm", that's not exactly encouraging.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#98

Post by sky_rw »

Nitramp wrote: post #94
watwut wrote: post #82

Earlier quoted context omitted.

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.

Dismissing the above use cases as "developer's whims" is the fundamental issue most people here are taking with these decisions.

I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. We are arguing for following a guideline that makes sense. This is why we have the w3c, an organization that attempts to weigh the needs of user, developers, and browser maintainers.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#99

Post by StavrosK »

jstanley wrote: post #83
StavrosK wrote: post #81

Earlier quoted context omitted.

Your comment about randomizing filenames got me thinking. It would be great if we could add a cache key to the HTML element, that way we could cache everything forever with the same filenames and still invalidate things by just making the key being the SHA of the deploy. Too bad that's not a thing.

That is a thing already! https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Subresource integrity is for ensuring that you got the right file (it fails if you didn't), it doesn't do anything with the cache, unfortunately.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#100

Post by rcxdude »

Carpetsmoker wrote: post #72
the_pwner224 wrote: post #5

Explanation from the 'rogue Chromium dev' is linked to in comment 19 of this bug: https://bugs.chromium.org/p/chromium/issues/detail?id=914451... https://bugs.chromium.org/p/chromium/issues/detail?id=468153...

> somewhere along the journey of the web autocomplete=off become a default for many form fields, without any real thought being given as to whether or not that was good for users And here I was, all along, thinking that website authors were in control of how their websites behaved. How silly of me!

They are in control of their servers. They are not in control of how the user agent (clue is in the name) interprets the javascript and HTML sent to it.
Post reply on HN