Chrome does not respect autocomplete=off (2018)

https://bugs.chromium.org/p/chromium/issues/detail?id=914451

by nikanj • 5 years ago

134 74 5 years ago

bugs.chromium.org

nikanj• 5 years ago

It’s pretty incredible to see the amount of steaming developers commenting on this issue. What tools do developers have, when platform providers turn a deaf ear to their needs?

Spivak3• 5 years ago

The problem is that you’re only seeing angry developers and not the angry users frustrated that they can’t use autofill on sites that disable it for no real reason. Sites being able to change the behavior of the user-agent is almost always a bad thing.

autocomplete=off should just be removed and it be entirely up to the user-agent whether it gets used like reader mode.

xirbeosbwo1234• 5 years ago

The browser can (and should) totally disregard what the webpage says if the user tells it to. The default should never be "break websites without asking the user".

cosmotic• 5 years ago

Well.... As a user of forms that intentionally add autocomplete=off so that their own autocomplete forms show instead, it is very not good to see both autocomplete mechanisms compete with each other.

mantap• 5 years ago

You've got to consider the 2nd order effects. Remove autocomplete=off? Developers will be forced to make their own DIY crappy text inputs just to get rid of it. And break everything but English input in the process.

crznp• 5 years ago

Alternately: User-agents changing the behavior of well-written sites without user knowledge is almost always a bad thing.

Giving the user more control is great: things like reader mode, option to disable auto-play video or options to kill resource-intensive scripts. This isn't a tool for the user, it is the browser's behavior whether the user wants it or not.

If autocomplete=off is user-hostile, then it should be changed in the spec. The spec gives a few use cases (site has its own autocomplete, field is sensitive information that shouldn't be cached, field is a one-time key). If autocomplete=off is removed, how would those cases be handled?

https://html.spec.whatwg.org/multipage/form-control-infrastr...

wbercx• 5 years ago

I've had several of our users call up over the years, angrily asking why we made certain fields in our app "dropdowns" with rubbish in them.

Chrome decided to add autocomplete to some of our fields with contextually irrelevant options. As far as I know there isn't anything I can reliably do about it.

chovybizzass• 5 years ago

nor should it. privacy settings should be up to user not the site.

merlinscholz• 5 years ago

This issue has (almost) nothing to do with privacy.

jojobas• 5 years ago

How does disabling auto-complete impact privacy? There are some examples in the thread - you can't have your address suggestion thingie display without Chrome's autocomplete on top of it.

kelnos2• 5 years ago

I think the purpose of autocomplete="off" is to allow an (honest, well-meaning) web site to tell a browser, "I know you think this looks like an address field, but it really isn't".

Unfortunately, in reality, it's probably more often used to force users to type things in for misguided "security reasons".

I think browser UI for this is generally just bad. I think forms should never auto-fill, but when I click on a form field, it should give me a dropdown to select text to put in just that field. Not that field plus all other fields in the form. Just that field. Then you don't have privacy issues (because the site never sees the autocomplete options unless the user actively selects one), and autocomplete="off" becomes unnecessary.

fshbbdssbbgdd• 5 years ago

Thanks, Chrome. So many sites have user-hostile code that is overridden by this choice. I still remember the glee when I first started using Chrome all those years ago, and suddenly all those forms filled themselves out.

colejohnson66• 5 years ago

I hate password forms that do this

Spivak3• 5 years ago

I wish I didn’t have to disable clipboard events because of sites that think they know better to disable paste.

eli• 5 years ago

I’ve seen autocomplete create plenty of problems. It can break some (admittedly poorly designed) forms outright. Or in others simply create a bad user experience. There are lots of forms that ask for an address but that should never be autocompleted to the user’s address.

In practice as a developer you have to resort to JavaScript hacks and obfuscating form field names to avoid it.

larzang• 5 years ago

Having worked on a number of CRM and other business applications, yep, it's maddening. Not all addresses and names are your address and name.

ehsankia• 5 years ago

I really really wish there was a way (holding shift, ctrl or something) to only autofill the one field without it goig to fill/replace every other field on the page. It's so annoying when the stuff you just field get replaced just because you want to autofill one field.

wongarsu• 5 years ago

But any new code that's being written just finds other ways to avoid autocomplete. Ignoring autocomplete=off makes the web a bit less standards compliant for a a very short temporary benefit.

wrwatson• 5 years ago

I'm the developer of a Virtual Terminal web page which allows a merchant to accept credit card payments. I would love to turn-off autocomplete for the credit card details. The person using the Virtual Terminal wants to type in someone else's card number, not use their own every time.

The PCI-DSS council is partly to blame here, for recommending autocomplete=off in other contexts.

chaganated• 5 years ago

So much (wasted) effort trying to work around Google's shitty autocomplete. The whole industry is practically sharecropping for Google now.

https://stackoverflow.com/questions/15738259/disabling-chrom...

suprfsat• 5 years ago

(2018)

cordite• 5 years ago

it's still active!

booblik• 5 years ago

Cool. Do paste blockers next.

issamehh• 5 years ago

While we're complaining about pasting, am I the only one who gets annoyed by sites that only have click to copy buttons for certain content? It's often either that or they try to help me out by highlighting it. What I really want is to highlight it myself so I can paste it into my terminal. It'd be great if there was a way to get the button click copies to go to my other clipboard but I can't find anything on it anywhere

daamsie• 5 years ago

Just in case you weren't aware - be careful copy / pasting into terminal.

https://thejh.net/misc/website-terminal-copy-paste

tshaddox• 5 years ago

It's pretty easy to make a website that has things that look and act like text inputs but which cannot be pasted into and cannot be detected as text inputs by the browser (short of something like computer vision, which I doubt will work well in practice).

shepherdjerred• 5 years ago

Don't give them any ideas

boring_twenties• 5 years ago

Does Chrome not have a setting for this? In Firefox it's as easy as changing dom.event.clipboardevents.enabled to false.

zelon882• 5 years ago

It is ironic that so many developers are taking the time to complain on the bug tracker but won't simply write Chrome out of their org. I did that at a place and most of the users didn't even realize something had changed.

No developers seem to have a problem simply refusing to support Firefox. I wonder how much extra effort it is going to take for them to finally make the switch.

meibo2• 5 years ago

Maybe you haven't checked this since 2013: https://gs.statcounter.com/browser-market-share

This statistic is not without reason. Chrome still has considerable usability and security advantages, especially for non-technical people(at least on anything that's not OS X), and still the best dev tools out there.

We can be lucky that FF at least tries to stick to standards where Safari doesn't bother.

kelnos2• 5 years ago

I don't think that's material. If we're talking about corporate policy on corporate-owned machines, employees shouldn't be complaining to IT that their favorite websites aren't working properly in Firefox. If they do, the canned IT response should always be "why are you doing personal tasks on your work machine?"

As long as the corporate/enterprise apps work on Firefox (which they should?), it's not a problem for a corporate IT department to ban Chrome.

martinmunk• 5 years ago

I’m not sure, but this might be related to my issues whenever I used chrome, and it would auto fill hidden elements of settings forms in pfSense. All of a sudden you had changed stuff you didn’t mean to, or get seemingly weird errors about invalid input.

At least I could imagine this prop being applied to hidden elements, either in pfSense or internally in chrome.

twistedpair• 5 years ago

I took our CI/CD pipelines offline when I edited one form in the CI/CD users admin panel, and Chrome autocompleted a hidden form, disabling various permissions. :/

dmitrygr2• 5 years ago

GOOD! Acting like a user agent, as it should be! If only there was also a way to cause unending pain to anyone who created those nasty "do not paste in here" javascript tricks too..

rurp• 5 years ago

That's great that Chrome happens to work as you like, but I am also a user and hate this behavior. How do I get Chrome to function as a user agent in this regard?

dmitrygr2• 5 years ago

https://www.computerhope.com/issues/ch001377.htm#chrome

Lorin• 5 years ago

The biggest UX issue I've seen are address inputs with coded dropdowns, only to have them covered by the Chrome autocomplete.

lsiebert• 5 years ago

Honestly this should be permission based, like you click a button to authorize disabling it in the browser.

undefined1• 5 years ago

related, is there any way to actually shut it off via Chrome?

I have the password manager disabled (supposedly) and using 1Password, but Chrome's version still pops up on login forms and interferes with 1Password.

anaganisk• 5 years ago

After turning off save password flag i never had that problem.

Jenk• 5 years ago

autocomplete="nope"

wat. Developer gag left unchecked?

themacguffinman• 5 years ago

IIUC "nope" used to be effective at disabling autocomplete because it's an invalid autocomplete value which Chrome treats differently from "off" (which it ignores) or "on" (which enables autocomplete). Chrome 81 should already have fixed this quirk.

rossdavidh• 5 years ago

I have been asked, by users, to turn off the autocomplete. I managed to do it by a hacky "change the id every time to a random new name then change it back upon submission" piece of js that I disliked. I wish I had known about the autocomplete=nope option.

chucklenorris• 5 years ago

Ofcourse they won't fix this. Autocomplete saves form values which are usually full of juicy information like addresses, names, ssn's, payment info, etc. which are vacuumed up by the data monster. Same with passwords. Even though the passwords themselves are encrypted it's amazing metadata to know which sites you have accounts for.

dataflow• 5 years ago

Why don't they put a flag to control this behavior in the browser? So that users who want it to be respected can actually get that?

ncann• 5 years ago

Chrome is extremely anti user choice. They have a very "we know better than you" attitude. There is about:flags but most flags are temporary and are eventually removed.

Traubenfuchs• 5 years ago

Every flag worsens complexity, size and maintainability...

banana_giraffe2• 5 years ago

I was asked by my users of an internal tool to disable autocomplete. I added autocomplete="off" and autocorrect="off" (spell checking makes no sense for this field), and it was disabled, including for chrome users.

Am I missing something? Is there some sort of heuristic to when it actually disables that I just got on the good side of by pure luck?

eternalny1• 5 years ago

Am I missing something? Is there some sort of heuristic to when it actually disables that I just got on the good side of by pure luck?

Yep, you are.

Chrome will fill in fields by not just looking at the autocomplete attribute, but also by trying to magically infer it based off the name attribute (and other heuristics).

For example, if you have a text entry box for a filename, and happen to set "name='name'" on it, even with autocomplete off you will get a pick list of people's names.

https://developers.google.com/web/fundamentals/design-and-ux...

banana_giraffe2• 5 years ago

Interesting, the label for this field is Name, but lucky for me I guess that I gave it a silly name based of the database field it maps to.

hombre_fatal• 5 years ago

Unfortunately, the decision to ignore the autocomplete attribute also makes it very hard to help the browser pick up the appropriate autofill username/password fields.

All browsers right now basically assume that if you have an input type="password", then the previous input type="text" must be the username field. And there's little you can do to change this without resorting to substantial hacks like using a hidden username-looking honeypot field to eat the poor browser behavior.

For example, imagine a pop-up confirmation box that asks you for your password before continuing. Or really just a "confirm password" field on any form. It can be very hard to get browser or extension password autofill to only affect that one field and not inject a username into some other field on the page. Password managers in browsers and extensions are surprisingly brain-dead, and they give us no tools to help them out.

To put UX first, especially around something as UX-sensitive as password autofill, you end up needing to put in a lot of extra work to make up for the browser's confidently-wrong implementations.

The original decision to ignore autocomplete="off" was probably the right move. But now that the autocomplete attribute has been overloaded with password manager concerns built in to web browsers these days, nobody has bothered to revisit the ordeal.

rsj_hn• 5 years ago

That's interesting. I almost never see "please enter password to confirm" but I always see (the more annoying) please enter username and password to confirm. Now I know why.

quink• 5 years ago

autocomplete="username"

autocomplete="current-password"

aftbit• 5 years ago

Why do forms still have nopaste support then? My bank occasionally makes me type an account number that I've copy/pasted from elsewhere in its interface. :(

maple3142• 5 years ago

It is not just a simple nopaste support, but a paste event listener. I guess back websites just uses preventDefault to prevent pasting. Although this is anti user, but it also has good use cases such as pasting image into a rich editor. Websites like Google Doc do have legitimate use of this feature.

oxplot• 5 years ago

I hate it when the websites try to disable autocomplete on login forms and I'm actually happy for browsers to override this anti-user behaviour.

globular-toast• 5 years ago

I have mixed feelings. I get the user agent argument, although it's hilarious to hear people say this about Chrome. My biggest pet peeve is that websites can decide to not let me use "/" to search in the page. They "cleverly" move your cursor to the search box. I have to use the clunky ctrl-f instead.

But I've also been bitten by autocomplete bugs. It has a strong tendency to make the user do the wrong thing and then forces developers to use silly hacks to stop it. It's not as bad as the IE6 days, but it's not ammillion miles away.

traspler• 5 years ago

I was a bit shocked when I was hit by this a couple of years back (2017) and learned that browsers are adamant about providing autocomplete, going so far as to infer the type from labels or placeholder strings.

The problem was even more frustrating because it seemed like disabling it was the only workaround to prevent a strange mobile Safari issue where the autocomplete bar would push the "next/prev element - Done" bar, on top of the keyboard, up so it would overlap the "position: fixed; bottom: 0;" element on the page (which was the input the user was trying to write into).

The argument that the user would complain to the browser vendor if he couldn't autocomplete is a bit strange to me. I would think the real novice users would begrudgingly accept the inconsistent behaviour and the users that do care about it would complain to the website they were on. But then again I haven't read any user studies regarding this.

mad182• 5 years ago

As a user, I think Chrome ignoring autocomplete=off is great and if it was a flag, I would enable it without hesitation. This feature is misused all the time.

harg• 5 years ago

How do you feel about the examples given in the thread like autocomplete suggestions overlaying a datepicker? Surely that's not great for anyone.

It may well be that disabling autocomplete is open to abuse, but it's not up to the browser venders to police the quality of webpages. There are plenty of other features that are abused all the time. Should browsers disable window.onscroll because it can be misused? How about all of JavaScript?

Chrome does not respect autocomplete=off (2018)

Related Stories