New issue
Advanced search Search tips

Issue 709303 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Delete credentials does not honoured in autocomplete

Reported by mahe...@googlemail.com, Apr 7 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce the problem:
1. Click the key icon on site with save credentials
2. Delete the chosen username/password
3. Focus on username or password field

What is the expected behavior?
Only live/undelete credentials should be offered

What went wrong?
The deleted credentials are still available to autocomplete

Did this work before? N/A 

Chrome version: 56.0.2924.87  Channel: n/a
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version:
 
Components: UI>Browser>Passwords UI>Browser>Autofill
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Via-Wizard-Security Type-Bug
Owner: vabr@chromium.org
Status: Assigned (was: Unconfirmed)
I don't think this is a security issue. +autofill/password folks to triage.

Comment 2 by vabr@chromium.org, Apr 7 2017

Owner: ----
Status: WontFix (was: Assigned)
This is working as intended. Removing the credential from the site which already had the opportunity to have them filled would be just a theatre, the site's scripts might be caching it, etc.
Why is it not then "theatre" to require to require a site "which already had the opportunity to have them filled" to use "fetch" and client-opaque credentials to log someone on?

Sign in to add a comment