Autocomplete for CVC remembers past values on Firefox - html

I added some autocomplete attributes on my payment form to allow Chrome and Safari users to save their credit card in their browsers.
I followed the Google Autofill instructions to do so.
<label for="frmNameCC">Name on card</label>
<input name="ccname" id="frmNameCC" required placeholder="Full Name" autocomplete="cc-name">
<label for="frmCCNum">Card Number</label>
<input name="cardnumber" id="frmCCNum" required autocomplete="cc-number">
<label for="frmCCCVC">CVC</label>
<input name="cvc" id="frmCCCVC" required autocomplete="cc-csc">
<label for="frmCCExp">Expiry</label>
<input name="cc-exp" id="frmCCExp" required placeholder="MM-YYYY" autocomplete="cc-exp">
By the way the official specs only use on or off as a value for the autocomplete attribute...
Anyways, it works pretty well. Unfortunately on Firefox (which doesn't have the feature to save a credit card) the input for CVC number [autocomplete="cc-csc"] remembers past values and suggests them in a dropdown list, which is really bad for security. At least, it seems to not remember past values of the card number input [autocomplete="cc-number"] which is the most important one.
Any workaround to suggest other than setting the CVC autocomplete to off.
If you have any documentation about FF behavior/support of those autocomplete values I'd really appreciate!
PS: I haven't checked on Internet Explorer/Edge.

Related

Prevent Personal Information autofill

How to prevent chromium based browser from sugesting personal information autofill for specific input?
<div class="form-group">
<label class="control-label" for="Nomenclature"> Nomenclature</label>
<input name="Nomenclature" class="form-control" id="Nomenclature" type="text" value="" autocomplete="off">
</div>
Somehow MS Edge assume this input is personal information, but it's not. As you can see, autocomplete is off for this input, so I guess Personal Information don't respect this attribute.
This behaviour is very annoying for users, because this input must be unique.
There are also other inputs in my portal that have this behaviour, and it makes no sense to users.
Simply add autocomplete="off" with form
More details:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

How do I disable or prevent input text suggestions for form fields in Edge?

How do I prevent a form from suggesting auto-complete values, from previous entries or from saved information in Edge?
In the above image, the email input field is marked as autocomplete="false", but still in the right pane you can see the suggestion is populating.
When I add autocomplete=disabled to one field it seems it work, but when I add the attribute to all the inputs, it again starts displaying suggestions for every field.
What is the solution for this?
Add the aria-autocomplete="list" attribute to the input.
<input type="text" id="FirstName" name="attr1" aria-autocomplete="list">
Do not use any other value for the attribute.
According to your description, I reproduced the problem. I think your issue is caused by the "Save and fill personal info" setting being enabled in Edge.
If you navigate to edge://settings/personalinfo and disable this feature, you can see this behavior no longer exists.
Or you can also click the "Manage personal info" option in the picture you provided, and then disable it.
I did some simple tests and found that if you need to solve the problem from the code, you need to modify the name attribute of the form's related field.
Like this(do not use attribute values like name or email... and maybe there are others I am not aware of):
<label for="attr1">attr1:</label>
<input type="text" id="FirstName" name="attr1">
<label for="attr2">attr2 :</label>
<input type="text" id="LastName" name="attr2">
<label for="attr3">attr3 :</label>
<input type="email" id="Email" name="attr3" autocomplete="off">
<input type="submit">
I don't recommend this, because good naming helps you understand and maintain the code. Using proper attributes like name and email also helps your code be more accessible for screen readers or other assistive technology.

How to turn off HTML input form field suggestions?

By suggestions, I mean the drop down menu appear when you start typing, and it's suggestions are based on what you've typed before:
For example, when I type 'a' in title field, it will give me a ton of suggestions which is pretty annoying.
How can this be turned off?
What you want is to disable HTML autocomplete Attribute.
Setting autocomplete="off" here has two effects:
It stops the browser from saving field data for later autocompletion
on similar forms though heuristics that vary by browser. It stops the
browser from caching form data in session history. When form data is
cached in session history, the information filled in by the user will
be visible after the user has submitted the form and clicked on the
Back button to go back to the original form page.
Read more on MDN Network
Here's an example how to do it.
<form action="#" autocomplete="on">
First name:<input type="text" name="fname"><br>
Last name: <input type="text" name="lname"><br>
E-mail: <input type="email" name="email" autocomplete="off"><br>
<input type="submit">
</form>
If it's on React framework then use as follows:
<input
id={field.name}
className="form-control"
type="text"
placeholder={field.name}
autoComplete="off"
{...fields}/>
Link to react docs
Update
Here's an update to fix some browsers skipping "autocomplete=off" flag.
<form action="#" autocomplete="off">
First name: <input type="text" name="fname" autocomplete="off" readonly onfocus="this.removeAttribute('readonly');"><br> Last name: <input type="text" name="lname" autocomplete="off" readonly onfocus="this.removeAttribute('readonly');"><br> E-mail:
<input type="email" name="email" autocomplete="off" readonly onfocus="this.removeAttribute('readonly');"><br>
<input type="submit">
</form>
On Chrome, the only method we could identify which prevented all form fills was to use autocomplete="new-password". Apply this on any input which shouldn't have autocomplete, and it'll be enforced (even if the field has nothing to do with passwords, e.g. SomeStateId filling with state form values). See this link on the Chromium bugs discussion for more detail.
Note that this only consistently works on Chromium-based browsers and Safari - Firefox doesn't have special handlers for this new-password (see this discussion for some detail).
Update: Firefox is coming aboard! Nightly v68.0a1 and Beta v67.0b5 (3/27/2019) feature support for the new-password autocomplete attribute, stable releases should be coming on 5/14/2019 per the roadmap.
Update in 2022: For input fields with a type of password, some browsers are now offering to generate secure passwords if you've specified autocomplete="new-password". There's currently no workaround if you want to suppress that behavior, but I'll update if one becomes available.
use autocomplete="off" attribute
Quote:IMPORTANT
Put the attribute on the <input> element,
NOT on the <form> element
Adding the two following attributes turn off all the field suggestions (tested on Chrome v85, Firefox v80 and Edge v44):
<input type="search" autocomplete="off">
I know it's been a while but if someone is looking for the answer this might help. I have used autocomplete="new-password" for the password field. and it solved my problem. Here is the MDN documentation.
This solution worked for me: Add readonly attribute.
Here's an update to fix some browsers skipping the
"autocomplete=off" flag.
<input type="text" name="lname" autocomplete="off" readonly onfocus="this.removeAttribute('readonly');">
autocomplete = "new-password" does not work for me.
I built a React Form.
Google Chrome will autocomplete the form input based on the name attribute.
<input
className="scp-remark"
type="text"
name="remark"
id='remark'
value={this.state.remark}
placeholder="Remark"
onChange={this.handleChange}
/>
It will base on the "name" attribute to decide whether to autofill your form. In this example, name: "remark". So Chrome will autofill based on all my previous "remark" inputs.
<input
className="scp-remark"
type="text"
name={uuid()} //disable Chrome autofill
id='remark'
value={this.state.remark}
placeholder="Remark"
onChange={this.handleChange}
/>
So, to hack this, I give name a random value using uuid() library.
import uuid from 'react-uuid';
Now, the autocomplete dropdown list will not happen.
I use the id attribute to identify the form input instead of name in the handleChange event handler
handleChange = (event) => {
const {id, value} = event.target;
this.setState({
[id]: value,
})
}
And it works for me.
I had similar issue but I eventually end up doing
<input id="inp1" autocomplete="off" maxlength="1" />
i.e.,
autocomplete = 'off' and suggestions will be disappeared.
<input type="text" autocomplete="off"> is in fact the right answer, though for me it wasn't immediately clear.
According to MDN:
If a browser keeps on making suggestions even after setting
autocomplete to off, then you have to change the name attribute of the
input element.
The attribute does prevent the future saving of data but it does not necessarily clear existing saved data. Thus, if suggestions are still being made even after setting the attribute to "off", either:
rename the input
clear existing data entries
Additionally, if you are working in a React context the attribute naturally becomes autoComplete.
Cheers!
I ended up changing the input field to
<textarea style="resize:none;"></textarea>
You'll never get autocomplete for textareas.
If you are using ReactJS. Then make this as autoComplete="off"
<input type="text" autoComplete="off" />

What are Apple's autofill field names?

Now that Mavericks is out, and it can use autofill to handle credit card info, are there specific field names they look for?
Well I'm not sure exactly about how Mavericks handles it but in chrome you can accomplish autofill in a way like this:
<form method="post" autocomplete="on">
<input name="cc-name" autocomplete="cc-name" type="text" placeholder="Full Name" required />
<input name="cc-number" autocomplete="cc-number" type="text" placeholder="Credit Card Number" required />
<input name="cc-exp" autocomplete="cc-exp" type="text" placeholder="Expire Date" required />
<input type="submit" name="submit" value="Send my personal info to this person.." />
</form>
If safari works how chrome does it might have a regex scanner that looks for familiar terms and fills it in to the best of it's ability. It's very difficult to find any full details on how properly write an autocomplete form. The best bet is try it out and see what works then update your post with your results.
From my research it seems that for an autocomplete form to be filled with credit card info the web page MUST be under a secure domain ( https:// )
This is a list of all the autofill values that might work http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html#autofill-field
Good luck! and don't abuse it.. That being said, not too many people will actually have their credit card set up for autofill for security reasons. I personally wouldn't for the risk of someone abusing the autofill feature and stealing my information with malicious JavaScript.

Why doesn't the browser give suggestions for this text field?

I have a basic text input for a login form and I'd like the browser to remember email addresses that the user has entered, but it's not working. I don't think I should need to add a full auto-complete system to get this to work since it's something the browser should be doing. I don't see anything special on sites I've visited where this works.
If I search for this problem all the answers are about disabling autocomplete.
Here's my login form:
<form id="login-form">
<fieldset>
<input id="email" type="email" placeholder="Your email" required="" >
<input id="password" type="password" placeholder="Pick a good password" required="" minlength="6">
<button class="login">Register</button>
</fieldset>
</form>
So the problem here seems to be that I didn't have a "name" attribute on my input. It also seems that I need to have specific values for the name. "email" works and "login" works, but "user_email" and "foo" don't work.
Surprisingly this started working as soon as I added 'name="email"' to the input, so it seems that Chrome was saving the values, but wasn't showing them.
This simple input is all you need for Chrome to do email autocomplete:
<input name="email">
I do not believe that you can force a user's browser to autocomplete.
HTML5 has an autocomplete form attribute.
Here is the W3C spec for autocomplete attribute.
However, even if you set this attribute to "on", the autocomplete of HTML forms is going to depend on the client's browser settings and configuration.
Although you can, as you said, disable autocomplete, there is not a way you can force the user's browser to autocomplete a form if they configure their browser not to remember form history.
For example, here is how to disable autocomplete for Firefox: https://developer.mozilla.org/en-US/docs/Mozilla/How_to_Turn_Off_Form_Autocompletion