Issue metadata
Sign in to add a comment
|
Credit card autofill is filling in unnamed inputs with credit card number.
Reported by
miche...@stripe.com,
Oct 23 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Steps to reproduce the problem: 1. go to https://jsfiddle.net/mchl/9n8ujz7j/23/ 2. use browser autofill to fill in the credit card input 3. additional, unmarked inputs are filled in (see: `.StripeField--fake` inputs) What is really strange is that when we serve the exact same application on a different domain, instead of js.stripe.com, this behavior does not appear: 1. go to https://jsfiddle.net/mchl/9n8ujz7j/24/ 2. use browser autofill to fill in the credit card input 3. additional, unmarked inputs are NOT filled in! We've diffed the production builds in question and there is no difference, except for the URL. (See diffs in next section.) We could also not reproduce this issue in local builds. What is the expected behavior? What went wrong? The non-credit-card-number input gets a credit card number filled in. Did this work before? Yes We can reproduce this on 60, 61, and 62 starting this morning. It seems more like some sort of feature flag that was turned on? Does this work in other browsers? Yes Chrome version: 61.0.3163.100 Channel: n/a OS Version: OS X 10.12.6 Flash Version: We chatted about this briefly with Jarred and Kumar at CDS today. Our thought: could js.stripe.com be whitelisted into some special behavior wrt autofill?
,
Oct 24 2017
,
Oct 24 2017
Some more data points: I was able to reproduce this issue with a build of Stripe.js from October 1, which definitely did not have this issue at that time: https://jsfiddle.net/mchl/zymuu7to/3/ We saw our first user report of this issue this morning at 11:36 AM PT: https://twitter.com/HenrikJoreteg/status/922532151526023169
,
Oct 24 2017
Thank you Michelle! This version of chrome has been out for a while, we will verify what could be the problem.
,
Oct 24 2017
Hi Michelle, I narrowed down the issue to two fake fields around the actual input field. See the screenshot**. In my DOM, there's one above and below the actual field. Autofill gets confused. On those fake fields that should never be autofilled, can you put autocomplete="fake" instead of autocomplete="off"? Let me know if that's a possibility and whether it would fix the issue. autocomplete="off" has been disregarded for a while. Second question, is the Stripe form always embedded in an iframe? ** You'll see that my DOM contains more information, because I've turned on chrome://flags#show-autofill-type-predictions
,
Oct 24 2017
Oh, that's an awesome Chrome flag! Thanks for the tip about `autocomplete="fake"` -- we'll go ahead use that instead for all of our fake inputs. Yes, Stripe.js inputs are always embedded in an iframe, for PCI reasons :).
,
Oct 26 2017
I'll close this bug as the issue was resolved. Thanks Michelle and sorry for the problems.
,
Oct 26 2017
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ligim...@chromium.org
, Oct 23 2017